Rev 6246 | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
Rev 6246 | Rev 6311 | ||
---|---|---|---|
Line 3... | Line 3... | ||
3 | ;; Copyright (C) KolibriOS team 2004-2016. All rights reserved. ;; |
3 | ;; Copyright (C) KolibriOS team 2004-2016. All rights reserved. ;; |
4 | ;; Distributed under terms of the GNU General Public License ;; |
4 | ;; Distributed under terms of the GNU General Public License ;; |
5 | ;; ;; |
5 | ;; ;; |
6 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; |
6 | ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; |
Line 7... | Line 7... | ||
7 | 7 | ||
Line 8... | Line 8... | ||
8 | $Revision: 6246 $ |
8 | $Revision: 6311 $ |
Line 9... | Line 9... | ||
9 | 9 | ||
10 | ; NTFS driver |
10 | ; NTFS driver |
Line 27... | Line 27... | ||
27 | ; Directories index $Filename (30h) attribute of all existing files. |
27 | ; Directories index $Filename (30h) attribute of all existing files. |
28 | ; $IndexRoot and $IndexAllocation attributes of a directory has a name — $I30. |
28 | ; $IndexRoot and $IndexAllocation attributes of a directory has a name — $I30. |
Line 29... | Line 29... | ||
29 | 29 | ||
30 | ; Offsets: |
30 | ; Offsets: |
- | 31 | ; record header |
|
31 | ; record header |
32 | magic = 0 |
32 | updateSequenceOffset = 4 |
33 | updateSequenceOffset = 4 |
- | 34 | updateSequenceSize = 6 |
|
33 | updateSequenceSize = 6 |
35 | ; FileRecord header |
34 | reuseCounter = 16 |
36 | reuseCounter = 16 |
35 | hardLinkCounter = 12h |
37 | hardLinkCounter = 12h |
36 | attributeOffset = 14h |
38 | attributeOffset = 14h |
37 | recordFlags = 16h |
39 | recordFlags = 16h |
Line 48... | Line 50... | ||
48 | nameOffset = 10 |
50 | nameOffset = 10 |
49 | attributeFlags = 12 |
51 | attributeFlags = 12 |
50 | attributeID = 14 |
52 | attributeID = 14 |
51 | ; resident attribute header |
53 | ; resident attribute header |
52 | sizeWithoutHeader = 10h |
54 | sizeWithoutHeader = 10h |
53 | ; attributeOffset = 14h |
55 | attributeOffset = 14h |
54 | indexedFlag = 16h |
56 | indexedFlag = 16h |
55 | ; non resident attribute header |
57 | ; non resident attribute header |
56 | firstVCN = 10h |
58 | firstVCN = 10h |
57 | lastVCN = 18h |
59 | lastVCN = 18h |
58 | dataRunsOffset = 20h |
60 | dataRunsOffset = 20h |
59 | attributeAllocatedSize = 28h |
61 | attributeAllocatedSize = 28h |
60 | attributeRealSize = 30h |
62 | attributeRealSize = 30h |
61 | initialDataSize = 38h |
63 | initialDataSize = 38h |
62 | ; $IndexRoot |
64 | ; $IndexRoot |
- | 65 | indexedAttributesType = 0 |
|
63 | collationRule = 4 |
66 | collationRule = 4 |
64 | indexRecordSize = 8 |
67 | indexRecordSize = 8 |
65 | indexRecordSizeClus = 12 |
68 | indexRecordSizeClus = 12 |
- | 69 | rootNode = 16 |
|
- | 70 | ; IndexRecord header |
|
- | 71 | recordVCN = 16 |
|
- | 72 | recordNode = 18h |
|
66 | ; node header |
73 | ; node header |
67 | indexOffset = 0 |
74 | indexOffset = 0 |
68 | nodeRealSize = 4 |
75 | nodeRealSize = 4 |
69 | nodeAllocatedSize = 8 |
76 | nodeAllocatedSize = 8 |
- | 77 | nonLeafFlag = 12 |
|
70 | ; $Filename index |
78 | ; $Filename index |
71 | fileRecordReference = 0 |
79 | fileRecordReference = 0 |
72 | fileReferenceReuse = 6 |
80 | fileReferenceReuse = 6 |
73 | indexAllocatedSize = 8 |
81 | indexAllocatedSize = 8 |
74 | indexRawSize = 10 |
82 | indexRawSize = 10 |
75 | indexFlags = 12 |
83 | indexFlags = 12 |
76 | directoryRecordReference = 16 |
84 | directoryRecordReference = 16 |
77 | directoryReferenceReuse = 16h |
85 | directoryReferenceReuse = 16h |
- | 86 | fileCreated = 18h |
|
- | 87 | fileModified = 20h |
|
- | 88 | recordModified = 28h |
|
- | 89 | fileAccessed = 30h |
|
78 | fileAllocatedSize = 38h |
90 | fileAllocatedSize = 38h |
79 | fileRealSize = 40h |
91 | fileRealSize = 40h |
80 | fileFlags = 48h |
92 | fileFlags = 48h |
81 | fileNameLength = 50h |
93 | fileNameLength = 50h |
- | 94 | namespace = 51h |
|
- | 95 | fileName = 52h |
|
Line 82... | Line 96... | ||
82 | 96 | ||
83 | struct NTFS PARTITION |
97 | struct NTFS PARTITION |
84 | Lock MUTEX ? ; Currently operations with one partition |
98 | Lock MUTEX ? ; Currently operations with one partition |
85 | ; can not be executed in parallel since the legacy code is not ready. |
99 | ; can not be executed in parallel since the legacy code is not ready. |
Line 101... | Line 115... | ||
101 | BitmapStart dd ? ; first byte after area, reserved for MFT |
115 | BitmapStart dd ? ; first byte after area, reserved for MFT |
102 | mftBitmapBuffer dd ? ; one cluster |
116 | mftBitmapBuffer dd ? ; one cluster |
103 | mftBitmapSize dd ? ; bytes readen |
117 | mftBitmapSize dd ? ; bytes readen |
104 | mftBitmapLocation dd ? ; starting sector |
118 | mftBitmapLocation dd ? ; starting sector |
Line 105... | Line 119... | ||
105 | 119 | ||
106 | ntfs_cur_attr dd ? ; attribute type |
120 | cur_attr dd ? ; attribute type |
107 | ntfs_cur_iRecord dd ? ; number of fileRecord in MFT |
121 | cur_iRecord dd ? ; number of fileRecord in MFT |
108 | ntfs_cur_offs dd ? ; attribute VCN in sectors |
122 | cur_offs dd ? ; attribute VCN in sectors |
109 | ntfs_cur_size dd ? ; max sectors to read |
123 | cur_size dd ? ; max sectors to read |
110 | ntfs_cur_buf dd ? |
124 | cur_buf dd ? |
111 | ntfs_cur_read dd ? ; bytes readen |
125 | cur_read dd ? ; bytes readen |
112 | ntfsLastRead dd ? ; last readen block of sectors |
126 | LastRead dd ? ; last readen block of sectors |
113 | newMftRecord dd ? ; number of fileRecord in MFT |
127 | newMftRecord dd ? ; number of fileRecord in MFT |
114 | fileDataStart dd ? ; starting cluster |
128 | fileDataStart dd ? ; starting cluster |
- | 129 | fileDataSize dd ? ; in clusters |
|
115 | fileDataSize dd ? ; in clusters |
130 | fileDataBuffer dd ? |
116 | fileRealSize dd ? ; in bytes |
131 | fileRealSize dd ? ; in bytes |
117 | indexOffset dd ? |
132 | indexOffset dd ? |
- | 133 | nodeLastRead dd ? |
|
118 | nodeLastRead dd ? |
134 | fragmentCount db ? |
119 | ntfs_bCanContinue db ? |
135 | bCanContinue db ? |
120 | ntfsFolder db ? |
136 | bFolder db ? |
121 | ntfsWriteAttr db ? ; Warning: Don't forget to turn off!!! |
- | |
Line 122... | Line 137... | ||
122 | ntfsFragmentCount db ? |
137 | bWriteAttr db ? ; Warning: Don't forget to turn off!!! |
123 | 138 | ||
124 | cur_subnode_size dd ? |
139 | cur_subnode_size dd ? |
125 | ntfs_attr_iRecord dd ? |
140 | attr_iRecord dd ? |
126 | ntfs_attr_iBaseRecord dd ? |
141 | attr_iBaseRecord dd ? |
127 | ntfs_attr_offs dd ? |
142 | attr_offs dd ? |
128 | ntfs_attr_list dd ? |
143 | attr_list dd ? |
129 | ntfs_attr_size dq ? |
144 | attr_size dq ? |
130 | ntfs_cur_tail dd ? |
145 | cur_tail dd ? |
131 | 146 | ||
132 | ntfs_attrlist_buf rb 0x400 |
147 | attrlist_buf rb 0x400 |
133 | ntfs_attrlist_mft_buf rb 0x400 |
148 | attrlist_mft_buf rb 0x400 |
Line 134... | Line 149... | ||
134 | ntfs_bitmap_buf rb 0x400 |
149 | bitmap_buf rb 0x400 |
135 | ends |
150 | ends |
136 | 151 | ||
Line 264... | Line 279... | ||
264 | call ntfs_test_bootsec |
279 | call ntfs_test_bootsec |
265 | jnc .ntfs_setup |
280 | jnc .ntfs_setup |
266 | .nope: |
281 | .nope: |
267 | xor eax, eax |
282 | xor eax, eax |
268 | jmp .exit |
283 | jmp .exit |
- | 284 | ||
269 | ; By given bootsector, initialize some NTFS variables |
285 | ; By given bootsector, initialize some NTFS variables |
270 | .ntfs_setup: |
286 | .ntfs_setup: |
271 | movi eax, sizeof.NTFS |
287 | movi eax, sizeof.NTFS |
272 | call malloc |
288 | call malloc |
273 | test eax, eax |
289 | test eax, eax |
Line 277... | Line 293... | ||
277 | mov ecx, dword [ebp+PARTITION.FirstSector+4] |
293 | mov ecx, dword [ebp+PARTITION.FirstSector+4] |
278 | mov dword [eax+NTFS.FirstSector+4], ecx |
294 | mov dword [eax+NTFS.FirstSector+4], ecx |
279 | mov ecx, [ebp+PARTITION.Disk] |
295 | mov ecx, [ebp+PARTITION.Disk] |
280 | mov [eax+NTFS.Disk], ecx |
296 | mov [eax+NTFS.Disk], ecx |
281 | mov [eax+NTFS.FSUserFunctions], ntfs_user_functions |
297 | mov [eax+NTFS.FSUserFunctions], ntfs_user_functions |
282 | mov [eax+NTFS.ntfsWriteAttr], 0 |
298 | mov [eax+NTFS.bWriteAttr], 0 |
Line 283... | Line 299... | ||
283 | 299 | ||
284 | push ebx ebp esi |
300 | push ebx ebp esi |
285 | mov ebp, eax |
301 | mov ebp, eax |
286 | lea ecx, [ebp+NTFS.Lock] |
302 | lea ecx, [ebp+NTFS.Lock] |
Line 298... | Line 314... | ||
298 | test eax, eax |
314 | test eax, eax |
299 | js @f |
315 | js @f |
300 | mul [ebp+NTFS.sectors_per_cluster] |
316 | mul [ebp+NTFS.sectors_per_cluster] |
301 | shl eax, 9 |
317 | shl eax, 9 |
302 | jmp .1 |
318 | jmp .1 |
- | 319 | ||
303 | @@: |
320 | @@: |
304 | neg eax |
321 | neg eax |
305 | mov ecx, eax |
322 | mov ecx, eax |
306 | mov eax, 1 |
323 | mov eax, 1 |
307 | shl eax, cl |
324 | shl eax, cl |
Line 353... | Line 370... | ||
353 | cmp byte [eax+9], 0 |
370 | cmp byte [eax+9], 0 |
354 | jz .founddata |
371 | jz .founddata |
355 | @@: |
372 | @@: |
356 | add eax, [eax+4] |
373 | add eax, [eax+4] |
357 | jmp .scandata |
374 | jmp .scandata |
- | 375 | ||
358 | .founddata: |
376 | .founddata: |
359 | cmp byte [eax+8], 0 |
377 | cmp byte [eax+8], 0 |
360 | jz .fail_free_mft |
378 | jz .fail_free_mft |
361 | ; load first portion of $DATA attribute retrieval information |
379 | ; load first portion of $DATA attribute retrieval information |
362 | mov edx, [eax+0x18] |
380 | mov edx, [eax+0x18] |
Line 373... | Line 391... | ||
373 | mov [eax], edx |
391 | mov [eax], edx |
374 | mov edx, [esp+8] ; block addr (relative) |
392 | mov edx, [esp+8] ; block addr (relative) |
375 | mov [eax+4], edx |
393 | mov [eax+4], edx |
376 | inc [ebp+NTFS.mft_retrieval_size] |
394 | inc [ebp+NTFS.mft_retrieval_size] |
377 | jmp .scanmcb |
395 | jmp .scanmcb |
- | 396 | ||
378 | .scanmcbend: |
397 | .scanmcbend: |
379 | add esp, 10h |
398 | add esp, 10h |
380 | ; there may be other portions of $DATA attribute in auxiliary records; |
399 | ; there may be other portions of $DATA attribute in auxiliary records; |
381 | ; if they will be needed, they will be loaded later |
400 | ; if they will be needed, they will be loaded later |
382 | mov [ebp+NTFS.cur_index_size], 0x1000/0x200 |
401 | mov [ebp+NTFS.cur_index_size], 0x1000/0x200 |
Line 395... | Line 414... | ||
395 | push eax |
414 | push eax |
396 | call alloc_kernel_space |
415 | call alloc_kernel_space |
397 | test eax, eax |
416 | test eax, eax |
398 | jz .failFreeIndex |
417 | jz .failFreeIndex |
399 | mov [ebp+NTFS.BitmapBuffer], eax |
418 | mov [ebp+NTFS.BitmapBuffer], eax |
400 | mov [ebp+NTFS.ntfs_cur_buf], eax |
419 | mov [ebp+NTFS.cur_buf], eax |
401 | mov eax, [ebp+NTFS.BitmapTotalSize] |
420 | mov eax, [ebp+NTFS.BitmapTotalSize] |
402 | add eax, [ebp+NTFS.mft_cluster] |
421 | add eax, [ebp+NTFS.mft_cluster] |
403 | shr eax, 3+2 ; reserve 1/8 of partition for $MFT |
422 | shr eax, 3+2 ; reserve 1/8 of partition for $MFT |
404 | shl eax, 2 |
423 | shl eax, 2 |
405 | mov [ebp+NTFS.BitmapStart], eax |
424 | mov [ebp+NTFS.BitmapStart], eax |
Line 407... | Line 426... | ||
407 | inc eax |
426 | inc eax |
408 | shl eax, 3 |
427 | shl eax, 3 |
409 | push eax |
428 | push eax |
410 | push eax |
429 | push eax |
411 | shl eax, 3 |
430 | shl eax, 3 |
412 | mov [ebp+NTFS.ntfs_cur_size], eax |
431 | mov [ebp+NTFS.cur_size], eax |
413 | call alloc_pages |
432 | call alloc_pages |
414 | test eax, eax |
433 | test eax, eax |
415 | pop ecx |
434 | pop ecx |
416 | jz .failFreeBitmap |
435 | jz .failFreeBitmap |
417 | add eax, 3 |
436 | add eax, 3 |
418 | mov ebx, [ebp+NTFS.BitmapBuffer] |
437 | mov ebx, [ebp+NTFS.BitmapBuffer] |
419 | call commit_pages |
438 | call commit_pages |
420 | mov [ebp+NTFS.ntfs_cur_iRecord], 6 |
439 | mov [ebp+NTFS.cur_iRecord], 6 |
421 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 |
440 | mov [ebp+NTFS.cur_attr], 0x80 |
422 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
441 | mov [ebp+NTFS.cur_offs], 0 |
423 | call ntfs_read_attr |
442 | call ntfs_read_attr |
424 | jc .failFreeBitmap |
443 | jc .failFreeBitmap |
425 | mov eax, [ebp+NTFS.ntfs_cur_read] |
444 | mov eax, [ebp+NTFS.cur_read] |
426 | mov [ebp+NTFS.BitmapSize], eax |
445 | mov [ebp+NTFS.BitmapSize], eax |
427 | mov eax, [ebp+NTFS.ntfsLastRead] |
446 | mov eax, [ebp+NTFS.LastRead] |
428 | mov [ebp+NTFS.BitmapLocation], eax |
447 | mov [ebp+NTFS.BitmapLocation], eax |
429 | ; read MFT $BITMAP attribute |
448 | ; read MFT $BITMAP attribute |
430 | mov eax, [ebp+NTFS.sectors_per_cluster] |
449 | mov eax, [ebp+NTFS.sectors_per_cluster] |
431 | mov [ebp+NTFS.ntfs_cur_size], eax |
450 | mov [ebp+NTFS.cur_size], eax |
432 | shl eax, 9 |
451 | shl eax, 9 |
433 | stdcall kernel_alloc, eax |
452 | stdcall kernel_alloc, eax |
434 | test eax, eax |
453 | test eax, eax |
435 | jz .failFreeBitmap |
454 | jz .failFreeBitmap |
436 | mov [ebp+NTFS.mftBitmapBuffer], eax |
455 | mov [ebp+NTFS.mftBitmapBuffer], eax |
437 | mov [ebp+NTFS.ntfs_cur_buf], eax |
456 | mov [ebp+NTFS.cur_buf], eax |
438 | mov [ebp+NTFS.ntfs_cur_iRecord], 0 |
457 | mov [ebp+NTFS.cur_iRecord], 0 |
439 | mov [ebp+NTFS.ntfs_cur_attr], 0xB0 |
458 | mov [ebp+NTFS.cur_attr], 0xB0 |
440 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
459 | mov [ebp+NTFS.cur_offs], 0 |
441 | call ntfs_read_attr |
460 | call ntfs_read_attr |
442 | mov eax, [ebp+NTFS.ntfs_cur_read] |
461 | mov eax, [ebp+NTFS.cur_read] |
443 | cmp eax, 4 |
462 | cmp eax, 4 |
444 | jc .failFreeBitmapMFT |
463 | jc .failFreeBitmapMFT |
445 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
464 | mov ecx, [ebp+NTFS.attr_offs] |
446 | cmp byte [ecx+nonResidentFlag], 1 |
465 | cmp byte [ecx+nonResidentFlag], 1 |
447 | jnz .failFreeBitmapMFT |
466 | jnz .failFreeBitmapMFT |
448 | mov [ebp+NTFS.mftBitmapSize], eax |
467 | mov [ebp+NTFS.mftBitmapSize], eax |
449 | mov eax, [ebp+NTFS.ntfsLastRead] |
468 | mov eax, [ebp+NTFS.LastRead] |
450 | mov [ebp+NTFS.mftBitmapLocation], eax |
469 | mov [ebp+NTFS.mftBitmapLocation], eax |
Line 451... | Line 470... | ||
451 | 470 | ||
452 | mov eax, ebp |
471 | mov eax, ebp |
453 | .pop_exit: |
472 | .pop_exit: |
Line 487... | Line 506... | ||
487 | test eax, eax |
506 | test eax, eax |
488 | jnz @f |
507 | jnz @f |
489 | popad |
508 | popad |
490 | add esp, 14h |
509 | add esp, 14h |
491 | jmp .fail_free_mft |
510 | jmp .fail_free_mft |
- | 511 | ||
492 | @@: |
512 | @@: |
493 | mov esi, [ebp+NTFS.mft_retrieval] |
513 | mov esi, [ebp+NTFS.mft_retrieval] |
494 | mov edi, eax |
514 | mov edi, eax |
495 | mov ecx, [ebp+NTFS.mft_retrieval_size] |
515 | mov ecx, [ebp+NTFS.mft_retrieval_size] |
496 | add ecx, ecx |
516 | add ecx, ecx |
Line 548... | Line 568... | ||
548 | pop ebx |
568 | pop ebx |
549 | pop ecx |
569 | pop ecx |
550 | ret |
570 | ret |
Line 551... | Line 571... | ||
551 | 571 | ||
552 | ntfs_read_attr: |
572 | ntfs_read_attr: |
553 | ; [ebp+NTFS.ntfsWriteAttr]=1 -> write attribute |
573 | ; [ebp+NTFS.bWriteAttr]=1 -> write attribute |
554 | ; in: |
574 | ; in: |
555 | ; [ebp+NTFS.ntfs_cur_iRecord] = number of fileRecord |
575 | ; [ebp+NTFS.cur_iRecord] = number of fileRecord |
556 | ; [ebp+NTFS.ntfs_cur_attr] = attribute type |
576 | ; [ebp+NTFS.cur_attr] = attribute type |
557 | ; [ebp+NTFS.ntfs_cur_offs] = attribute VCN in sectors |
577 | ; [ebp+NTFS.cur_offs] = attribute VCN in sectors |
558 | ; [ebp+NTFS.ntfs_cur_buf] -> buffer for data |
578 | ; [ebp+NTFS.cur_buf] -> buffer for data |
559 | ; [ebp+NTFS.ntfs_cur_size] = max sectors to read |
579 | ; [ebp+NTFS.cur_size] = max sectors to read |
560 | ; out: |
580 | ; out: |
561 | ; [ebp+NTFS.ntfs_cur_read] = bytes readen |
581 | ; [ebp+NTFS.cur_read] = bytes readen |
562 | ; CF=1 -> failed, eax = disk error code, eax=0 -> something with FS |
582 | ; CF=1 -> failed, eax = disk error code, eax=0 -> something with FS |
563 | xor eax, eax |
583 | xor eax, eax |
564 | pushad |
584 | pushad |
565 | and [ebp+NTFS.ntfs_cur_read], 0 |
585 | and [ebp+NTFS.cur_read], 0 |
566 | cmp [ebp+NTFS.ntfs_cur_iRecord], 0 |
586 | cmp [ebp+NTFS.cur_iRecord], 0 |
567 | jnz .nomft |
587 | jnz .nomft |
568 | cmp [ebp+NTFS.ntfs_cur_attr], 0x80 |
588 | cmp [ebp+NTFS.cur_attr], 0x80 |
569 | jnz .nomft |
589 | jnz .nomft |
570 | mov eax, [ebp+NTFS.mft_retrieval_end] |
590 | mov eax, [ebp+NTFS.mft_retrieval_end] |
571 | inc eax |
591 | inc eax |
572 | mul [ebp+NTFS.sectors_per_cluster] |
592 | mul [ebp+NTFS.sectors_per_cluster] |
573 | cmp eax, [ebp+NTFS.ntfs_cur_offs] |
593 | cmp eax, [ebp+NTFS.cur_offs] |
574 | jbe .nomft |
594 | jbe .nomft |
575 | ; precalculated part of $Mft $DATA |
595 | ; precalculated part of $Mft $DATA |
576 | mov esi, [ebp+NTFS.mft_retrieval] |
596 | mov esi, [ebp+NTFS.mft_retrieval] |
577 | mov eax, [ebp+NTFS.ntfs_cur_offs] |
597 | mov eax, [ebp+NTFS.cur_offs] |
578 | xor edx, edx |
598 | xor edx, edx |
579 | div [ebp+NTFS.sectors_per_cluster] |
599 | div [ebp+NTFS.sectors_per_cluster] |
580 | ; eax = VCN, edx = offset in sectors from beginning of cluster |
600 | ; eax = VCN, edx = offset in sectors from beginning of cluster |
581 | xor ecx, ecx ; ecx will contain LCN |
601 | xor ecx, ecx ; ecx will contain LCN |
Line 590... | Line 610... | ||
590 | add eax, [ebp+NTFS.mft_retrieval] |
610 | add eax, [ebp+NTFS.mft_retrieval] |
591 | cmp eax, esi |
611 | cmp eax, esi |
592 | pop eax |
612 | pop eax |
593 | jnz .mftscan |
613 | jnz .mftscan |
594 | jmp .nomft |
614 | jmp .nomft |
- | 615 | ||
595 | @@: |
616 | @@: |
596 | push ecx |
617 | push ecx |
597 | add ecx, eax |
618 | add ecx, eax |
598 | add ecx, [esi] |
619 | add ecx, [esi] |
599 | push eax |
620 | push eax |
Line 601... | Line 622... | ||
601 | mov eax, [ebp+NTFS.sectors_per_cluster] |
622 | mov eax, [ebp+NTFS.sectors_per_cluster] |
602 | mul ecx |
623 | mul ecx |
603 | ; eax = sector on partition |
624 | ; eax = sector on partition |
604 | pop edx |
625 | pop edx |
605 | add eax, edx |
626 | add eax, edx |
606 | mov ebx, [ebp+NTFS.ntfs_cur_buf] |
627 | mov ebx, [ebp+NTFS.cur_buf] |
607 | pop ecx |
628 | pop ecx |
608 | neg ecx |
629 | neg ecx |
609 | imul ecx, [ebp+NTFS.sectors_per_cluster] |
630 | imul ecx, [ebp+NTFS.sectors_per_cluster] |
610 | sub ecx, edx |
631 | sub ecx, edx |
611 | mov [ebp+NTFS.ntfsLastRead], eax |
632 | mov [ebp+NTFS.LastRead], eax |
612 | cmp ecx, [ebp+NTFS.ntfs_cur_size] |
633 | cmp ecx, [ebp+NTFS.cur_size] |
613 | jb @f |
634 | jb @f |
614 | mov ecx, [ebp+NTFS.ntfs_cur_size] |
635 | mov ecx, [ebp+NTFS.cur_size] |
615 | @@: |
636 | @@: |
616 | ; ecx = number of sequential sectors to read |
637 | ; ecx = number of sequential sectors to read |
617 | push eax |
638 | push eax |
618 | call fs_read32_sys |
639 | call fs_read32_sys |
619 | pop edx |
640 | pop edx |
620 | test eax, eax |
641 | test eax, eax |
621 | jnz .errread |
642 | jnz .errread |
622 | add [ebp+NTFS.ntfs_cur_read], 0x200 |
643 | add [ebp+NTFS.cur_read], 0x200 |
623 | dec [ebp+NTFS.ntfs_cur_size] |
644 | dec [ebp+NTFS.cur_size] |
624 | inc [ebp+NTFS.ntfs_cur_offs] |
645 | inc [ebp+NTFS.cur_offs] |
625 | add ebx, 0x200 |
646 | add ebx, 0x200 |
626 | mov [ebp+NTFS.ntfs_cur_buf], ebx |
647 | mov [ebp+NTFS.cur_buf], ebx |
627 | lea eax, [edx+1] |
648 | lea eax, [edx+1] |
628 | loop @b |
649 | loop @b |
629 | pop ecx |
650 | pop ecx |
630 | xor eax, eax |
651 | xor eax, eax |
631 | xor edx, edx |
652 | xor edx, edx |
632 | cmp [ebp+NTFS.ntfs_cur_size], eax |
653 | cmp [ebp+NTFS.cur_size], eax |
633 | jz @f |
654 | jz @f |
634 | add esi, 8 |
655 | add esi, 8 |
635 | push eax |
656 | push eax |
636 | mov eax, [ebp+NTFS.mft_retrieval_end] |
657 | mov eax, [ebp+NTFS.mft_retrieval_end] |
637 | shl eax, 3 |
658 | shl eax, 3 |
638 | add eax, [ebp+NTFS.mft_retrieval] |
659 | add eax, [ebp+NTFS.mft_retrieval] |
639 | cmp eax, esi |
660 | cmp eax, esi |
640 | pop eax |
661 | pop eax |
641 | jz .nomft |
662 | jz .nomft |
642 | jmp .mftscan |
663 | jmp .mftscan |
643 | @@: |
664 | |
- | 665 | .errret2_pop: |
|
644 | popad |
666 | xor eax, eax |
- | 667 | .errret_pop: |
|
645 | ret |
668 | pop ecx |
646 | .errread: |
669 | .errread: |
647 | pop ecx |
670 | pop ecx |
648 | .errret: |
671 | .errret: |
649 | mov [esp+28], eax |
672 | mov [esp+28], eax |
650 | stc |
673 | stc |
- | 674 | @@: |
|
651 | popad |
675 | popad |
652 | ret |
676 | ret |
- | 677 | ||
653 | .nomft: |
678 | .nomft: |
654 | ; 1. Read file record. |
679 | ; 1. Read file record. |
655 | ; N.B. This will do recursive call of read_attr for $MFT::$Data. |
680 | ; N.B. This will do recursive call of read_attr for $MFT::$Data. |
656 | mov eax, [ebp+NTFS.ntfs_cur_iRecord] |
681 | mov eax, [ebp+NTFS.cur_iRecord] |
657 | mov [ebp+NTFS.ntfs_attr_iRecord], eax |
682 | mov [ebp+NTFS.attr_iRecord], eax |
658 | and [ebp+NTFS.ntfs_attr_list], 0 |
683 | and [ebp+NTFS.attr_list], 0 |
659 | or dword [ebp+NTFS.ntfs_attr_size], -1 |
684 | or dword [ebp+NTFS.attr_size], -1 |
660 | or dword [ebp+NTFS.ntfs_attr_size+4], -1 |
685 | or dword [ebp+NTFS.attr_size+4], -1 |
661 | or [ebp+NTFS.ntfs_attr_iBaseRecord], -1 |
686 | or [ebp+NTFS.attr_iBaseRecord], -1 |
662 | call ntfs_read_file_record |
687 | call ntfs_read_file_record |
663 | jc .errret |
688 | jc .errret |
664 | ; 2. Find required attribute. |
689 | ; 2. Find required attribute. |
665 | mov eax, [ebp+NTFS.frs_buffer] |
690 | mov eax, [ebp+NTFS.frs_buffer] |
666 | ; a) For auxiliary records, read base record. |
691 | ; a) For auxiliary records, read base record. |
667 | ; If base record is present, base iRecord may be 0 (for $Mft), |
692 | ; If base record is present, base iRecord may be 0 (for $Mft), |
668 | ; but SequenceNumber is nonzero. |
693 | ; but SequenceNumber is nonzero. |
669 | cmp dword [eax+24h], 0 |
694 | cmp word [eax+baseRecordReuse], 0 |
670 | jz @f |
695 | jz @f |
671 | mov eax, [eax+20h] |
696 | mov eax, [eax+baseRecordReference] |
672 | .beginfindattr: |
697 | .beginfindattr: |
673 | mov [ebp+NTFS.ntfs_attr_iRecord], eax |
698 | mov [ebp+NTFS.attr_iRecord], eax |
674 | call ntfs_read_file_record |
699 | call ntfs_read_file_record |
675 | jc .errret |
700 | jc .errret |
676 | jmp @f |
701 | jmp @f |
- | 702 | ||
677 | .newAttribute: |
703 | .newAttribute: |
678 | pushad |
704 | pushad |
- | 705 | and [ebp+NTFS.cur_read], 0 |
|
679 | @@: |
706 | @@: |
680 | ; b) Scan for required attribute and for $ATTR_LIST |
707 | ; b) Scan for required attribute and for $ATTR_LIST |
681 | mov eax, [ebp+NTFS.frs_buffer] |
708 | mov eax, [ebp+NTFS.frs_buffer] |
682 | movzx ecx, word [eax+14h] |
709 | movzx ecx, word [eax+attributeOffset] |
683 | add eax, ecx |
710 | add eax, ecx |
684 | mov ecx, [ebp+NTFS.ntfs_cur_attr] |
711 | mov ecx, [ebp+NTFS.cur_attr] |
685 | and [ebp+NTFS.ntfs_attr_offs], 0 |
712 | and [ebp+NTFS.attr_offs], 0 |
686 | .scanattr: |
713 | .scanattr: |
687 | cmp dword [eax], -1 |
714 | cmp dword [eax], -1 |
688 | jz .scandone |
715 | jz .scandone |
689 | cmp dword [eax], ecx |
716 | cmp dword [eax], ecx |
690 | jz .okattr |
717 | jz .okattr |
691 | cmp [ebp+NTFS.ntfs_attr_iBaseRecord], -1 |
718 | cmp [ebp+NTFS.attr_iBaseRecord], -1 |
692 | jnz .scancont |
719 | jnz .scancont |
693 | cmp dword [eax], 0x20 ; $ATTR_LIST |
720 | cmp dword [eax], 0x20 ; $ATTR_LIST |
694 | jnz .scancont |
721 | jnz .scancont |
695 | mov [ebp+NTFS.ntfs_attr_list], eax |
722 | mov [ebp+NTFS.attr_list], eax |
696 | jmp .scancont |
723 | jmp .scancont |
- | 724 | ||
697 | .okattr: |
725 | .okattr: |
698 | ; ignore named $DATA attributes (aka NTFS streams) |
726 | ; ignore named $DATA attributes (aka NTFS streams) |
699 | cmp ecx, 0x80 |
727 | cmp ecx, 0x80 |
700 | jnz @f |
728 | jnz @f |
701 | cmp byte [eax+9], 0 |
729 | cmp byte [eax+nameLength], 0 |
702 | jnz .scancont |
730 | jnz .scancont |
703 | @@: |
731 | @@: |
704 | mov [ebp+NTFS.ntfs_attr_offs], eax |
732 | mov [ebp+NTFS.attr_offs], eax |
705 | .scancont: |
733 | .scancont: |
706 | add eax, [eax+4] |
734 | add eax, [eax+sizeWithHeader] |
707 | jmp .scanattr |
735 | jmp .scanattr |
- | 736 | ||
708 | .continue: |
737 | .continue: |
709 | pushad |
738 | pushad |
710 | and [ebp+NTFS.ntfs_cur_read], 0 |
739 | and [ebp+NTFS.cur_read], 0 |
711 | .scandone: |
740 | .scandone: |
712 | ; c) Check for required offset and length |
741 | ; c) Check for required offset and length |
713 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
742 | mov ecx, [ebp+NTFS.attr_offs] |
714 | jecxz .noattr |
743 | jecxz .noattr |
715 | push [ebp+NTFS.ntfs_cur_size] |
744 | push [ebp+NTFS.cur_size] |
716 | push [ebp+NTFS.ntfs_cur_read] |
745 | push [ebp+NTFS.cur_read] |
717 | call .doreadattr |
746 | call .doreadattr |
718 | pop edx |
747 | pop edx |
719 | pop ecx |
748 | pop ecx |
720 | jc @f |
749 | jc .ret |
721 | cmp [ebp+NTFS.ntfs_bCanContinue], 0 |
750 | cmp [ebp+NTFS.bCanContinue], 0 |
722 | jz @f |
751 | jz .ret |
723 | sub edx, [ebp+NTFS.ntfs_cur_read] |
752 | sub edx, [ebp+NTFS.cur_read] |
724 | neg edx |
753 | neg edx |
725 | shr edx, 9 |
754 | shr edx, 9 |
726 | sub ecx, edx |
755 | sub ecx, edx |
727 | mov [ebp+NTFS.ntfs_cur_size], ecx |
756 | mov [ebp+NTFS.cur_size], ecx |
728 | jnz .not_in_cur |
757 | jz .ret |
729 | @@: |
- | |
730 | popad |
- | |
731 | ret |
- | |
732 | .noattr: |
758 | .noattr: |
733 | .not_in_cur: |
- | |
734 | cmp [ebp+NTFS.ntfs_cur_attr], 0x20 |
759 | cmp [ebp+NTFS.cur_attr], 0x20 |
735 | jz @f |
760 | jz @f |
736 | mov ecx, [ebp+NTFS.ntfs_attr_list] |
761 | mov ecx, [ebp+NTFS.attr_list] |
737 | test ecx, ecx |
762 | test ecx, ecx |
738 | jnz .lookattr |
763 | jnz .lookattr |
739 | .ret_is_attr: |
764 | .ret_is_attr: |
740 | and dword [esp+28], 0 |
765 | and dword [esp+28], 0 |
741 | cmp [ebp+NTFS.ntfs_attr_offs], 1 ; CF set <=> ntfs_attr_offs == 0 |
766 | cmp [ebp+NTFS.attr_offs], 1 ; define CF |
- | 767 | .ret: |
|
742 | popad |
768 | popad |
743 | ret |
769 | ret |
- | 770 | ||
744 | .lookattr: |
771 | .lookattr: |
745 | ; required attribute or required offset was not found in base record; |
772 | ; required attribute or required offset was not found in base record; |
746 | ; it may be present in auxiliary records; |
773 | ; it may be present in auxiliary records; |
747 | ; scan $ATTR_LIST |
774 | ; scan $ATTR_LIST |
748 | mov eax, [ebp+NTFS.ntfs_attr_iBaseRecord] |
775 | mov eax, [ebp+NTFS.attr_iBaseRecord] |
749 | cmp eax, -1 |
776 | cmp eax, -1 |
750 | jz @f |
777 | jz @f |
751 | call ntfs_read_file_record |
778 | call ntfs_read_file_record |
752 | jc .errret |
779 | jc .errret |
753 | or [ebp+NTFS.ntfs_attr_iBaseRecord], -1 |
780 | or [ebp+NTFS.attr_iBaseRecord], -1 |
754 | @@: |
781 | @@: |
755 | push [ebp+NTFS.ntfs_cur_offs] |
782 | push [ebp+NTFS.cur_offs] |
756 | push [ebp+NTFS.ntfs_cur_size] |
783 | push [ebp+NTFS.cur_size] |
757 | push [ebp+NTFS.ntfs_cur_read] |
784 | push [ebp+NTFS.cur_read] |
758 | push [ebp+NTFS.ntfs_cur_buf] |
785 | push [ebp+NTFS.cur_buf] |
759 | push dword [ebp+NTFS.ntfs_attr_size] |
786 | push dword [ebp+NTFS.attr_size] |
760 | push dword [ebp+NTFS.ntfs_attr_size+4] |
787 | push dword [ebp+NTFS.attr_size+4] |
761 | or dword [ebp+NTFS.ntfs_attr_size], -1 |
788 | or dword [ebp+NTFS.attr_size], -1 |
762 | or dword [ebp+NTFS.ntfs_attr_size+4], -1 |
789 | or dword [ebp+NTFS.attr_size+4], -1 |
763 | and [ebp+NTFS.ntfs_cur_offs], 0 |
790 | and [ebp+NTFS.cur_offs], 0 |
764 | mov [ebp+NTFS.ntfs_cur_size], 2 |
791 | mov [ebp+NTFS.cur_size], 2 |
765 | and [ebp+NTFS.ntfs_cur_read], 0 |
792 | and [ebp+NTFS.cur_read], 0 |
766 | lea eax, [ebp+NTFS.ntfs_attrlist_buf] |
793 | lea eax, [ebp+NTFS.attrlist_buf] |
767 | cmp [ebp+NTFS.ntfs_cur_iRecord], 0 |
794 | cmp [ebp+NTFS.cur_iRecord], 0 |
768 | jnz @f |
795 | jnz @f |
769 | lea eax, [ebp+NTFS.ntfs_attrlist_mft_buf] |
796 | lea eax, [ebp+NTFS.attrlist_mft_buf] |
770 | @@: |
797 | @@: |
771 | mov [ebp+NTFS.ntfs_cur_buf], eax |
798 | mov [ebp+NTFS.cur_buf], eax |
772 | push eax |
799 | push eax |
773 | call .doreadattr |
800 | call .doreadattr |
774 | pop esi |
801 | pop esi |
775 | mov edx, 1 |
802 | mov edx, 1 |
776 | pop dword [ebp+NTFS.ntfs_attr_size+4] |
803 | pop dword [ebp+NTFS.attr_size+4] |
777 | pop dword [ebp+NTFS.ntfs_attr_size] |
804 | pop dword [ebp+NTFS.attr_size] |
778 | mov ecx, [ebp+NTFS.ntfs_cur_read] |
805 | mov ecx, [ebp+NTFS.cur_read] |
779 | pop [ebp+NTFS.ntfs_cur_buf] |
806 | pop [ebp+NTFS.cur_buf] |
780 | pop [ebp+NTFS.ntfs_cur_read] |
807 | pop [ebp+NTFS.cur_read] |
781 | pop [ebp+NTFS.ntfs_cur_size] |
808 | pop [ebp+NTFS.cur_size] |
782 | pop [ebp+NTFS.ntfs_cur_offs] |
809 | pop [ebp+NTFS.cur_offs] |
783 | jc .errret |
810 | jc .errret |
784 | or edi, -1 |
811 | or edi, -1 |
785 | lea ecx, [ecx+esi-1Ah] |
812 | lea ecx, [ecx+esi-1Ah] |
786 | .scanliststart: |
813 | .scanliststart: |
787 | push ecx |
814 | push ecx |
788 | mov eax, [ebp+NTFS.ntfs_cur_attr] |
815 | mov eax, [ebp+NTFS.cur_attr] |
789 | .scanlist: |
816 | .scanlist: |
790 | cmp esi, [esp] |
817 | cmp esi, [esp] |
791 | jae .scanlistdone |
818 | jae .scanlistdone |
792 | cmp eax, [esi] |
819 | cmp eax, [esi] |
793 | jz @f |
820 | jz @f |
794 | .scanlistcont: |
821 | .scanlistcont: |
795 | movzx ecx, word [esi+4] |
822 | movzx ecx, word [esi+4] |
796 | add esi, ecx |
823 | add esi, ecx |
797 | jmp .scanlist |
824 | jmp .scanlist |
- | 825 | ||
798 | @@: |
826 | @@: |
799 | ; ignore named $DATA attributes (aka NTFS streams) |
827 | ; ignore named $DATA attributes (aka NTFS streams) |
800 | cmp eax, 0x80 |
828 | cmp eax, 0x80 |
801 | jnz @f |
829 | jnz @f |
802 | cmp byte [esi+6], 0 |
830 | cmp byte [esi+6], 0 |
Line 804... | Line 832... | ||
804 | @@: |
832 | @@: |
805 | push eax |
833 | push eax |
806 | mov eax, [esi+8] |
834 | mov eax, [esi+8] |
807 | test eax, eax |
835 | test eax, eax |
808 | jnz .testf |
836 | jnz .testf |
809 | mov eax, dword [ebp+NTFS.ntfs_attr_size] |
837 | mov eax, dword [ebp+NTFS.attr_size] |
810 | and eax, dword [ebp+NTFS.ntfs_attr_size+4] |
838 | and eax, dword [ebp+NTFS.attr_size+4] |
811 | cmp eax, -1 |
839 | cmp eax, -1 |
812 | jnz .testfz |
840 | jnz .testfz |
813 | ; if attribute is in auxiliary records, its size is defined only in first |
841 | ; if attribute is in auxiliary records, its size is defined only in first |
814 | mov eax, [esi+10h] |
842 | mov eax, [esi+10h] |
815 | call ntfs_read_file_record |
843 | call ntfs_read_file_record |
816 | jnc @f |
- | |
817 | .errret_pop: |
- | |
818 | pop ecx ecx |
- | |
819 | jmp .errret |
- | |
820 | .errret2_pop: |
- | |
821 | xor eax, eax |
- | |
822 | jmp .errret_pop |
844 | jc .errret_pop |
823 | @@: |
- | |
824 | mov eax, [ebp+NTFS.frs_buffer] |
845 | mov eax, [ebp+NTFS.frs_buffer] |
825 | movzx ecx, word [eax+14h] |
846 | movzx ecx, word [eax+14h] |
826 | add eax, ecx |
847 | add eax, ecx |
827 | mov ecx, [ebp+NTFS.ntfs_cur_attr] |
848 | mov ecx, [ebp+NTFS.cur_attr] |
828 | @@: |
849 | @@: |
829 | cmp dword [eax], -1 |
850 | cmp dword [eax], -1 |
830 | jz .errret2_pop |
851 | jz .errret2_pop |
831 | cmp dword [eax], ecx |
852 | cmp dword [eax], ecx |
832 | jz @f |
853 | jz @f |
833 | .l1: |
854 | .l1: |
834 | add eax, [eax+4] |
855 | add eax, [eax+4] |
835 | jmp @b |
856 | jmp @b |
- | 857 | ||
836 | @@: |
858 | @@: |
837 | cmp eax, 0x80 |
859 | cmp eax, 0x80 |
838 | jnz @f |
860 | jnz @f |
839 | cmp byte [eax+9], 0 |
861 | cmp byte [eax+9], 0 |
840 | jnz .l1 |
862 | jnz .l1 |
841 | @@: |
863 | @@: |
842 | cmp byte [eax+8], 0 |
864 | cmp byte [eax+8], 0 |
843 | jnz .sdnores |
865 | jnz .sdnores |
844 | mov eax, [eax+10h] |
866 | mov eax, [eax+10h] |
845 | mov dword [ebp+NTFS.ntfs_attr_size], eax |
867 | mov dword [ebp+NTFS.attr_size], eax |
846 | and dword [ebp+NTFS.ntfs_attr_size+4], 0 |
868 | and dword [ebp+NTFS.attr_size+4], 0 |
847 | jmp .testfz |
869 | jmp .testfz |
- | 870 | ||
848 | .sdnores: |
871 | .sdnores: |
849 | mov ecx, [eax+30h] |
872 | mov ecx, [eax+30h] |
850 | mov dword [ebp+NTFS.ntfs_attr_size], ecx |
873 | mov dword [ebp+NTFS.attr_size], ecx |
851 | mov ecx, [eax+34h] |
874 | mov ecx, [eax+34h] |
852 | mov dword [ebp+NTFS.ntfs_attr_size+4], ecx |
875 | mov dword [ebp+NTFS.attr_size+4], ecx |
853 | .testfz: |
876 | .testfz: |
854 | xor eax, eax |
877 | xor eax, eax |
855 | .testf: |
878 | .testf: |
856 | imul eax, [ebp+NTFS.sectors_per_cluster] |
879 | imul eax, [ebp+NTFS.sectors_per_cluster] |
857 | cmp eax, [ebp+NTFS.ntfs_cur_offs] |
880 | cmp eax, [ebp+NTFS.cur_offs] |
858 | pop eax |
881 | pop eax |
859 | ja @f |
882 | ja @f |
860 | mov edi, [esi+10h] ; keep previous iRecord |
883 | mov edi, [esi+10h] ; keep previous iRecord |
861 | jmp .scanlistcont |
884 | jmp .scanlistcont |
- | 885 | ||
862 | @@: |
886 | @@: |
863 | pop ecx |
887 | pop ecx |
864 | .scanlistfound: |
888 | .scanlistfound: |
865 | cmp edi, -1 |
889 | cmp edi, -1 |
866 | jnz @f |
890 | jz .ret |
867 | popad |
- | |
868 | ret |
- | |
869 | @@: |
- | |
870 | mov eax, [ebp+NTFS.ntfs_cur_iRecord] |
891 | mov eax, [ebp+NTFS.cur_iRecord] |
871 | mov [ebp+NTFS.ntfs_attr_iBaseRecord], eax |
892 | mov [ebp+NTFS.attr_iBaseRecord], eax |
872 | mov eax, edi |
893 | mov eax, edi |
873 | jmp .beginfindattr |
894 | jmp .beginfindattr |
- | 895 | ||
874 | .scanlistdone: |
896 | .scanlistdone: |
875 | pop ecx |
897 | pop ecx |
876 | sub ecx, ebp |
898 | sub ecx, ebp |
877 | sub ecx, NTFS.ntfs_attrlist_buf-1Ah |
899 | sub ecx, NTFS.attrlist_buf-1Ah |
878 | cmp [ebp+NTFS.ntfs_cur_iRecord], 0 |
900 | cmp [ebp+NTFS.cur_iRecord], 0 |
879 | jnz @f |
901 | jnz @f |
880 | sub ecx, NTFS.ntfs_attrlist_mft_buf-NTFS.ntfs_attrlist_buf |
902 | sub ecx, NTFS.attrlist_mft_buf-NTFS.attrlist_buf |
881 | @@: |
903 | @@: |
882 | cmp ecx, 0x400 |
904 | cmp ecx, 0x400 |
883 | jnz .scanlistfound |
905 | jnz .scanlistfound |
884 | inc edx |
906 | inc edx |
885 | push esi edi |
907 | push esi edi |
886 | lea esi, [ebp+NTFS.ntfs_attrlist_buf+0x200] |
908 | lea esi, [ebp+NTFS.attrlist_buf+0x200] |
887 | lea edi, [ebp+NTFS.ntfs_attrlist_buf] |
909 | lea edi, [ebp+NTFS.attrlist_buf] |
888 | cmp [ebp+NTFS.ntfs_cur_iRecord], 0 |
910 | cmp [ebp+NTFS.cur_iRecord], 0 |
889 | jnz @f |
911 | jnz @f |
890 | lea esi, [ebp+NTFS.ntfs_attrlist_mft_buf+0x200] |
912 | lea esi, [ebp+NTFS.attrlist_mft_buf+0x200] |
891 | lea edi, [ebp+NTFS.ntfs_attrlist_mft_buf] |
913 | lea edi, [ebp+NTFS.attrlist_mft_buf] |
892 | @@: |
914 | @@: |
893 | mov ecx, 0x200/4 |
915 | mov ecx, 0x200/4 |
894 | rep movsd |
916 | rep movsd |
895 | mov eax, edi |
917 | mov eax, edi |
896 | pop edi esi |
918 | pop edi esi |
897 | sub esi, 0x200 |
919 | sub esi, 0x200 |
898 | push [ebp+NTFS.ntfs_cur_offs] |
920 | push [ebp+NTFS.cur_offs] |
899 | push [ebp+NTFS.ntfs_cur_size] |
921 | push [ebp+NTFS.cur_size] |
900 | push [ebp+NTFS.ntfs_cur_read] |
922 | push [ebp+NTFS.cur_read] |
901 | push [ebp+NTFS.ntfs_cur_buf] |
923 | push [ebp+NTFS.cur_buf] |
902 | push dword [ebp+NTFS.ntfs_attr_size] |
924 | push dword [ebp+NTFS.attr_size] |
903 | push dword [ebp+NTFS.ntfs_attr_size+4] |
925 | push dword [ebp+NTFS.attr_size+4] |
904 | or dword [ebp+NTFS.ntfs_attr_size], -1 |
926 | or dword [ebp+NTFS.attr_size], -1 |
905 | or dword [ebp+NTFS.ntfs_attr_size+4], -1 |
927 | or dword [ebp+NTFS.attr_size+4], -1 |
906 | mov [ebp+NTFS.ntfs_cur_offs], edx |
928 | mov [ebp+NTFS.cur_offs], edx |
907 | mov [ebp+NTFS.ntfs_cur_size], 1 |
929 | mov [ebp+NTFS.cur_size], 1 |
908 | and [ebp+NTFS.ntfs_cur_read], 0 |
930 | and [ebp+NTFS.cur_read], 0 |
909 | mov [ebp+NTFS.ntfs_cur_buf], eax |
931 | mov [ebp+NTFS.cur_buf], eax |
910 | mov ecx, [ebp+NTFS.ntfs_attr_list] |
932 | mov ecx, [ebp+NTFS.attr_list] |
911 | push esi edx edi |
933 | push esi edx edi |
912 | call .doreadattr |
934 | call .doreadattr |
913 | pop edi edx esi |
935 | pop edi edx esi |
914 | mov ecx, [ebp+NTFS.ntfs_cur_read] |
936 | mov ecx, [ebp+NTFS.cur_read] |
915 | pop dword [ebp+NTFS.ntfs_attr_size+4] |
937 | pop dword [ebp+NTFS.attr_size+4] |
916 | pop dword [ebp+NTFS.ntfs_attr_size] |
938 | pop dword [ebp+NTFS.attr_size] |
917 | pop [ebp+NTFS.ntfs_cur_buf] |
939 | pop [ebp+NTFS.cur_buf] |
918 | pop [ebp+NTFS.ntfs_cur_read] |
940 | pop [ebp+NTFS.cur_read] |
919 | pop [ebp+NTFS.ntfs_cur_size] |
941 | pop [ebp+NTFS.cur_size] |
920 | pop [ebp+NTFS.ntfs_cur_offs] |
942 | pop [ebp+NTFS.cur_offs] |
921 | jc .errret |
943 | jc .errret |
922 | lea ecx, [ecx+ebp+NTFS.ntfs_attrlist_buf+0x200-0x1A] |
944 | lea ecx, [ecx+ebp+NTFS.attrlist_buf+0x200-0x1A] |
923 | cmp [ebp+NTFS.ntfs_cur_iRecord], 0 |
945 | cmp [ebp+NTFS.cur_iRecord], 0 |
924 | jnz .scanliststart |
946 | jnz .scanliststart |
925 | add ecx, NTFS.ntfs_attrlist_mft_buf-NTFS.ntfs_attrlist_buf |
947 | add ecx, NTFS.attrlist_mft_buf-NTFS.attrlist_buf |
926 | jmp .scanliststart |
948 | jmp .scanliststart |
Line 927... | Line 949... | ||
927 | 949 | ||
928 | .doreadattr: |
950 | .doreadattr: |
929 | mov [ebp+NTFS.ntfs_bCanContinue], 0 |
951 | mov [ebp+NTFS.bCanContinue], 0 |
930 | cmp byte [ecx+8], 0 |
952 | cmp byte [ecx+nonResidentFlag], 0 |
931 | jnz .nonresident |
953 | jnz .nonresident |
932 | mov eax, [ecx+10h] ; length |
954 | mov eax, [ecx+sizeWithoutHeader] |
933 | mov esi, eax |
955 | mov esi, eax |
934 | mov edx, [ebp+NTFS.ntfs_cur_offs] |
956 | mov edx, [ebp+NTFS.cur_offs] |
935 | shr eax, 9 |
957 | shr eax, 9 |
936 | cmp eax, edx |
958 | cmp eax, edx |
937 | jb .okret |
959 | jb .okret |
938 | shl edx, 9 |
960 | shl edx, 9 |
939 | sub esi, edx |
961 | sub esi, edx |
940 | movzx eax, word [ecx+14h] |
962 | movzx eax, word [ecx+attributeOffset] |
941 | add edx, eax |
963 | add edx, eax |
942 | add edx, ecx ; edx -> data |
964 | add edx, ecx ; edx -> data |
943 | mov eax, [ebp+NTFS.ntfs_cur_size] |
965 | mov eax, [ebp+NTFS.cur_size] |
944 | cmp eax, (0xFFFFFFFF shr 9)+1 |
966 | cmp eax, (0xFFFFFFFF shr 9)+1 |
945 | jbe @f |
967 | jbe @f |
946 | mov eax, (0xFFFFFFFF shr 9)+1 |
968 | mov eax, (0xFFFFFFFF shr 9)+1 |
947 | @@: |
969 | @@: |
948 | shl eax, 9 |
970 | shl eax, 9 |
949 | cmp eax, esi |
971 | cmp eax, esi |
950 | jbe @f |
972 | jbe @f |
951 | mov eax, esi |
973 | mov eax, esi |
952 | @@: |
974 | @@: |
953 | ; eax = length, edx -> data |
975 | ; eax = length, edx -> data |
954 | mov [ebp+NTFS.ntfs_cur_read], eax |
976 | mov [ebp+NTFS.cur_read], eax |
955 | mov ecx, eax |
977 | mov ecx, eax |
956 | mov eax, edx |
978 | mov eax, edx |
957 | mov ebx, [ebp+NTFS.ntfs_cur_buf] |
979 | mov ebx, [ebp+NTFS.cur_buf] |
958 | call memmove |
980 | call memmove |
959 | and [ebp+NTFS.ntfs_cur_size], 0 ; CF=0 |
981 | and [ebp+NTFS.cur_size], 0 ; CF=0 |
- | 982 | ret |
|
960 | ret |
983 | |
961 | .nonresident: |
984 | .nonresident: |
962 | ; Not all auxiliary records contain correct FileSize info |
985 | ; Not all auxiliary records contain correct FileSize info |
963 | mov eax, dword [ebp+NTFS.ntfs_attr_size] |
986 | mov eax, dword [ebp+NTFS.attr_size] |
964 | mov edx, dword [ebp+NTFS.ntfs_attr_size+4] |
987 | mov edx, dword [ebp+NTFS.attr_size+4] |
965 | push eax |
988 | push eax |
966 | and eax, edx |
989 | and eax, edx |
967 | cmp eax, -1 |
990 | cmp eax, -1 |
968 | pop eax |
991 | pop eax |
969 | jnz @f |
992 | jnz @f |
970 | mov eax, [ecx+30h] ; FileSize |
993 | mov eax, [ecx+attributeRealSize] |
971 | mov edx, [ecx+34h] |
994 | mov edx, [ecx+attributeRealSize+4] |
972 | mov dword [ebp+NTFS.ntfs_attr_size], eax |
995 | mov dword [ebp+NTFS.attr_size], eax |
973 | mov dword [ebp+NTFS.ntfs_attr_size+4], edx |
996 | mov dword [ebp+NTFS.attr_size+4], edx |
974 | @@: |
997 | @@: |
975 | add eax, 0x1FF |
998 | add eax, 0x1FF |
976 | adc edx, 0 |
999 | adc edx, 0 |
977 | shrd eax, edx, 9 |
1000 | shrd eax, edx, 9 |
978 | sub eax, [ebp+NTFS.ntfs_cur_offs] |
1001 | sub eax, [ebp+NTFS.cur_offs] |
979 | ja @f |
1002 | ja @f |
980 | ; return with nothing read |
1003 | ; return with nothing read |
981 | and [ebp+NTFS.ntfs_cur_size], 0 |
1004 | and [ebp+NTFS.cur_size], 0 |
982 | .okret: |
1005 | .okret: |
983 | clc |
1006 | clc |
- | 1007 | ret |
|
984 | ret |
1008 | |
985 | @@: |
1009 | @@: |
986 | ; reduce read length |
1010 | ; reduce read length |
987 | and [ebp+NTFS.ntfs_cur_tail], 0 |
1011 | and [ebp+NTFS.cur_tail], 0 |
988 | cmp [ebp+NTFS.ntfs_cur_size], eax |
1012 | cmp [ebp+NTFS.cur_size], eax |
989 | jb @f |
1013 | jb @f |
990 | mov [ebp+NTFS.ntfs_cur_size], eax |
1014 | mov [ebp+NTFS.cur_size], eax |
991 | mov eax, dword [ebp+NTFS.ntfs_attr_size] |
1015 | mov eax, dword [ebp+NTFS.attr_size] |
992 | and eax, 0x1FF |
1016 | and eax, 0x1FF |
993 | mov [ebp+NTFS.ntfs_cur_tail], eax |
1017 | mov [ebp+NTFS.cur_tail], eax |
994 | @@: |
1018 | @@: |
995 | cmp [ebp+NTFS.ntfs_cur_size], 0 |
1019 | cmp [ebp+NTFS.cur_size], 0 |
996 | jz .okret |
1020 | jz .okret |
997 | mov eax, [ebp+NTFS.ntfs_cur_offs] |
1021 | mov eax, [ebp+NTFS.cur_offs] |
998 | xor edx, edx |
1022 | xor edx, edx |
999 | div [ebp+NTFS.sectors_per_cluster] |
1023 | div [ebp+NTFS.sectors_per_cluster] |
1000 | sub eax, [ecx+10h] ; first_vbo |
1024 | sub eax, [ecx+firstVCN] |
1001 | jb .okret |
1025 | jb .okret |
1002 | ; eax = cluster, edx = starting sector |
1026 | ; eax = cluster, edx = starting sector |
1003 | cmp [ebp+NTFS.ntfs_cur_attr], 0x80 |
1027 | cmp [ebp+NTFS.cur_attr], 0x80 |
1004 | jnz .sys |
1028 | jnz .sys |
1005 | cmp [ebp+NTFS.ntfs_cur_iRecord], 0 |
1029 | cmp [ebp+NTFS.cur_iRecord], 0 |
1006 | jz .sys |
1030 | jz .sys |
1007 | push fs_read64_app |
1031 | push fs_read64_app |
1008 | cmp [ebp+NTFS.ntfsWriteAttr], 1 |
1032 | cmp [ebp+NTFS.bWriteAttr], 1 |
1009 | jnz @f |
1033 | jnz @f |
1010 | mov dword[esp], fs_write64_app |
1034 | mov dword[esp], fs_write64_app |
- | 1035 | jmp @f |
|
1011 | jmp @f |
1036 | |
1012 | .sys: |
1037 | .sys: |
1013 | push fs_read64_sys |
1038 | push fs_read64_sys |
1014 | @@: |
1039 | @@: |
1015 | sub esp, 10h |
1040 | sub esp, 10h |
1016 | movzx esi, word [ecx+20h] ; mcb_info_ofs |
1041 | movzx esi, word [ecx+dataRunsOffset] |
1017 | add esi, ecx |
1042 | add esi, ecx |
1018 | xor edi, edi |
1043 | xor edi, edi |
1019 | mov [ebp+NTFS.ntfsFragmentCount], 0 |
1044 | mov [ebp+NTFS.fragmentCount], 0 |
1020 | .readloop: |
1045 | .readloop: |
1021 | call ntfs_decode_mcb_entry |
1046 | call ntfs_decode_mcb_entry |
1022 | jnc .break |
1047 | jnc .break |
1023 | add edi, [esp+8] |
1048 | add edi, [esp+8] |
Line 1031... | Line 1056... | ||
1031 | add eax, edx |
1056 | add eax, edx |
1032 | pop ecx |
1057 | pop ecx |
1033 | neg ecx |
1058 | neg ecx |
1034 | imul ecx, [ebp+NTFS.sectors_per_cluster] |
1059 | imul ecx, [ebp+NTFS.sectors_per_cluster] |
1035 | sub ecx, edx |
1060 | sub ecx, edx |
1036 | cmp ecx, [ebp+NTFS.ntfs_cur_size] |
1061 | cmp ecx, [ebp+NTFS.cur_size] |
1037 | jb @f |
1062 | jb @f |
1038 | mov ecx, [ebp+NTFS.ntfs_cur_size] |
1063 | mov ecx, [ebp+NTFS.cur_size] |
1039 | @@: |
1064 | @@: |
1040 | mov ebx, [ebp+NTFS.ntfs_cur_buf] |
1065 | mov ebx, [ebp+NTFS.cur_buf] |
1041 | mov [ebp+NTFS.ntfsLastRead], eax |
1066 | mov [ebp+NTFS.LastRead], eax |
1042 | push ecx |
1067 | push ecx |
1043 | xor edx, edx |
1068 | xor edx, edx |
1044 | call dword[esp+18h] |
1069 | call dword[esp+18h] |
1045 | pop ecx |
1070 | pop ecx |
1046 | test eax, eax |
1071 | test eax, eax |
1047 | jnz .errread2 |
1072 | jnz .errread2 |
1048 | sub [ebp+NTFS.ntfs_cur_size], ecx |
1073 | sub [ebp+NTFS.cur_size], ecx |
1049 | add [ebp+NTFS.ntfs_cur_offs], ecx |
1074 | add [ebp+NTFS.cur_offs], ecx |
1050 | shl ecx, 9 |
1075 | shl ecx, 9 |
1051 | add [ebp+NTFS.ntfs_cur_read], ecx |
1076 | add [ebp+NTFS.cur_read], ecx |
1052 | add [ebp+NTFS.ntfs_cur_buf], ecx |
1077 | add [ebp+NTFS.cur_buf], ecx |
1053 | inc [ebp+NTFS.ntfsFragmentCount] |
1078 | inc [ebp+NTFS.fragmentCount] |
1054 | pop ecx |
1079 | pop ecx |
1055 | xor eax, eax |
1080 | xor eax, eax |
1056 | xor edx, edx |
1081 | xor edx, edx |
1057 | cmp [ebp+NTFS.ntfs_cur_size], 0 |
1082 | cmp [ebp+NTFS.cur_size], 0 |
1058 | jnz .readloop |
1083 | jnz .readloop |
1059 | add esp, 14h |
1084 | add esp, 14h |
1060 | mov eax, [ebp+NTFS.ntfs_cur_tail] |
1085 | mov eax, [ebp+NTFS.cur_tail] |
1061 | test eax, eax |
1086 | test eax, eax |
1062 | jz @f |
1087 | jz @f |
1063 | sub eax, 0x200 |
1088 | sub eax, 0x200 |
1064 | add [ebp+NTFS.ntfs_cur_read], eax |
1089 | add [ebp+NTFS.cur_read], eax |
1065 | @@: |
1090 | @@: |
1066 | clc |
1091 | clc |
1067 | ret |
1092 | ret |
- | 1093 | ||
1068 | .errread2: |
1094 | .errread2: |
1069 | pop ecx |
1095 | pop ecx |
1070 | add esp, 14h |
1096 | add esp, 14h |
1071 | stc |
1097 | stc |
1072 | ret |
1098 | ret |
- | 1099 | ||
1073 | .break: |
1100 | .break: |
1074 | add esp, 14h ; CF=0 |
1101 | add esp, 14h ; CF=0 |
1075 | mov [ebp+NTFS.ntfs_bCanContinue], 1 |
1102 | mov [ebp+NTFS.bCanContinue], 1 |
1076 | ret |
1103 | ret |
Line 1077... | Line 1104... | ||
1077 | 1104 | ||
1078 | ntfs_read_file_record: |
1105 | ntfs_read_file_record: |
1079 | ; in: eax = iRecord |
1106 | ; in: eax = iRecord |
Line 1084... | Line 1111... | ||
1084 | mov ecx, [ebp+NTFS.frs_size] |
1111 | mov ecx, [ebp+NTFS.frs_size] |
1085 | mul ecx |
1112 | mul ecx |
1086 | shrd eax, edx, 9 |
1113 | shrd eax, edx, 9 |
1087 | shr edx, 9 |
1114 | shr edx, 9 |
1088 | jnz .errret |
1115 | jnz .errret |
1089 | push [ebp+NTFS.ntfs_attr_iRecord] |
1116 | push [ebp+NTFS.attr_iRecord] |
1090 | push [ebp+NTFS.ntfs_attr_iBaseRecord] |
1117 | push [ebp+NTFS.attr_iBaseRecord] |
1091 | push [ebp+NTFS.ntfs_attr_offs] |
1118 | push [ebp+NTFS.attr_offs] |
1092 | push [ebp+NTFS.ntfs_attr_list] |
1119 | push [ebp+NTFS.attr_list] |
1093 | push dword [ebp+NTFS.ntfs_attr_size+4] |
1120 | push dword [ebp+NTFS.attr_size+4] |
1094 | push dword [ebp+NTFS.ntfs_attr_size] |
1121 | push dword [ebp+NTFS.attr_size] |
1095 | push [ebp+NTFS.ntfs_cur_iRecord] |
1122 | push [ebp+NTFS.cur_iRecord] |
1096 | push [ebp+NTFS.ntfs_cur_attr] |
1123 | push [ebp+NTFS.cur_attr] |
1097 | push [ebp+NTFS.ntfs_cur_offs] |
1124 | push [ebp+NTFS.cur_offs] |
1098 | push [ebp+NTFS.ntfs_cur_size] |
1125 | push [ebp+NTFS.cur_size] |
1099 | push [ebp+NTFS.ntfs_cur_buf] |
1126 | push [ebp+NTFS.cur_buf] |
1100 | push [ebp+NTFS.ntfs_cur_read] |
1127 | push [ebp+NTFS.cur_read] |
1101 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 ; $DATA |
1128 | mov [ebp+NTFS.cur_attr], 0x80 ; $DATA |
1102 | and [ebp+NTFS.ntfs_cur_iRecord], 0 ; $Mft |
1129 | and [ebp+NTFS.cur_iRecord], 0 ; $Mft |
1103 | mov [ebp+NTFS.ntfs_cur_offs], eax |
1130 | mov [ebp+NTFS.cur_offs], eax |
1104 | shr ecx, 9 |
1131 | shr ecx, 9 |
1105 | mov [ebp+NTFS.ntfs_cur_size], ecx |
1132 | mov [ebp+NTFS.cur_size], ecx |
1106 | mov eax, [ebp+NTFS.frs_buffer] |
1133 | mov eax, [ebp+NTFS.frs_buffer] |
1107 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1134 | mov [ebp+NTFS.cur_buf], eax |
1108 | call ntfs_read_attr |
1135 | call ntfs_read_attr |
1109 | mov edx, [ebp+NTFS.ntfs_cur_read] |
1136 | mov edx, [ebp+NTFS.cur_read] |
1110 | pop [ebp+NTFS.ntfs_cur_read] |
1137 | pop [ebp+NTFS.cur_read] |
1111 | pop [ebp+NTFS.ntfs_cur_buf] |
1138 | pop [ebp+NTFS.cur_buf] |
1112 | pop [ebp+NTFS.ntfs_cur_size] |
1139 | pop [ebp+NTFS.cur_size] |
1113 | pop [ebp+NTFS.ntfs_cur_offs] |
1140 | pop [ebp+NTFS.cur_offs] |
1114 | pop [ebp+NTFS.ntfs_cur_attr] |
1141 | pop [ebp+NTFS.cur_attr] |
1115 | pop [ebp+NTFS.ntfs_cur_iRecord] |
1142 | pop [ebp+NTFS.cur_iRecord] |
1116 | pop dword [ebp+NTFS.ntfs_attr_size] |
1143 | pop dword [ebp+NTFS.attr_size] |
1117 | pop dword [ebp+NTFS.ntfs_attr_size+4] |
1144 | pop dword [ebp+NTFS.attr_size+4] |
1118 | pop [ebp+NTFS.ntfs_attr_list] |
1145 | pop [ebp+NTFS.attr_list] |
1119 | pop [ebp+NTFS.ntfs_attr_offs] |
1146 | pop [ebp+NTFS.attr_offs] |
1120 | pop [ebp+NTFS.ntfs_attr_iBaseRecord] |
1147 | pop [ebp+NTFS.attr_iBaseRecord] |
1121 | pop [ebp+NTFS.ntfs_attr_iRecord] |
1148 | pop [ebp+NTFS.attr_iRecord] |
1122 | jc .ret |
1149 | jc .ret |
1123 | cmp edx, [ebp+NTFS.frs_size] |
1150 | cmp edx, [ebp+NTFS.frs_size] |
1124 | jnz .errret |
1151 | jnz .errret |
1125 | mov eax, [ebp+NTFS.frs_buffer] |
1152 | mov eax, [ebp+NTFS.frs_buffer] |
1126 | cmp dword [eax], 'FILE' |
1153 | cmp dword [eax], 'FILE' |
Line 1131... | Line 1158... | ||
1131 | pop ebx |
1158 | pop ebx |
1132 | jc .errret |
1159 | jc .errret |
1133 | .ret: |
1160 | .ret: |
1134 | pop edx ecx |
1161 | pop edx ecx |
1135 | ret |
1162 | ret |
- | 1163 | ||
1136 | .errret: |
1164 | .errret: |
1137 | pop edx ecx |
1165 | pop edx ecx |
1138 | xor eax, eax |
1166 | xor eax, eax |
1139 | stc |
1167 | stc |
1140 | ret |
1168 | ret |
Line 1147... | Line 1175... | ||
1147 | ; eax = size in bytes |
1175 | ; eax = size in bytes |
1148 | pushad |
1176 | pushad |
1149 | shr eax, 9 |
1177 | shr eax, 9 |
1150 | mov ecx, eax |
1178 | mov ecx, eax |
1151 | inc eax |
1179 | inc eax |
1152 | cmp [ebx+6], ax |
1180 | cmp [ebx+updateSequenceSize], ax |
1153 | jnz .err |
1181 | jnz .err |
1154 | movzx eax, word [ebx+4] |
1182 | movzx eax, word [ebx+updateSequenceOffset] |
1155 | lea esi, [eax+ebx] |
1183 | lea esi, [eax+ebx] |
1156 | lodsw |
1184 | lodsw |
1157 | mov edx, eax |
1185 | mov edx, eax |
1158 | lea edi, [ebx+0x1FE] |
1186 | lea edi, [ebx+0x1FE] |
1159 | @@: |
1187 | @@: |
Line 1164... | Line 1192... | ||
1164 | add edi, 0x1FE |
1192 | add edi, 0x1FE |
1165 | loop @b |
1193 | loop @b |
1166 | popad |
1194 | popad |
1167 | clc |
1195 | clc |
1168 | ret |
1196 | ret |
- | 1197 | ||
1169 | .err: |
1198 | .err: |
1170 | popad |
1199 | popad |
1171 | stc |
1200 | stc |
1172 | ret |
1201 | ret |
Line 1231... | Line 1260... | ||
1231 | ret |
1260 | ret |
Line 1232... | Line 1261... | ||
1232 | 1261 | ||
1233 | ntfs_find_lfn: |
1262 | ntfs_find_lfn: |
1234 | ; in: [esi]+[esp+4] = name |
1263 | ; in: [esi]+[esp+4] = name |
1235 | ; out: |
1264 | ; out: |
1236 | ; [ebp+NTFS.ntfs_cur_iRecord] = number of MFT fileRecord |
1265 | ; [ebp+NTFS.cur_iRecord] = number of MFT fileRecord |
1237 | ; eax -> index in the parent index node |
1266 | ; eax -> index in the parent index node |
1238 | ; CF=1 -> file not found, eax=0 -> error |
1267 | ; CF=1 -> file not found, eax=0 -> error |
1239 | mov [ebp+NTFS.ntfs_cur_iRecord], 5 ; start parse from root cluster |
1268 | mov [ebp+NTFS.cur_iRecord], 5 ; start from root directory |
1240 | .doit2: |
1269 | .doit2: |
1241 | mov [ebp+NTFS.ntfs_cur_attr], 0x90 ; $INDEX_ROOT |
1270 | mov [ebp+NTFS.cur_attr], 0x90 ; $INDEX_ROOT |
1242 | and [ebp+NTFS.ntfs_cur_offs], 0 |
1271 | and [ebp+NTFS.cur_offs], 0 |
1243 | mov eax, [ebp+NTFS.cur_index_size] |
1272 | mov eax, [ebp+NTFS.cur_index_size] |
1244 | mov [ebp+NTFS.ntfs_cur_size], eax |
1273 | mov [ebp+NTFS.cur_size], eax |
1245 | mov eax, [ebp+NTFS.cur_index_buf] |
1274 | mov eax, [ebp+NTFS.cur_index_buf] |
1246 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1275 | mov [ebp+NTFS.cur_buf], eax |
1247 | call ntfs_read_attr |
1276 | call ntfs_read_attr |
1248 | mov eax, 0 |
1277 | mov eax, 0 |
1249 | jnc @f |
- | |
1250 | .ret: |
- | |
1251 | ret 4 |
- | |
1252 | @@: |
1278 | jc .ret |
1253 | cmp [ebp+NTFS.ntfs_cur_read], 0x20 |
1279 | cmp [ebp+NTFS.cur_read], 0x20 |
1254 | jc .ret |
1280 | jc .ret |
1255 | pushad |
1281 | pushad |
1256 | mov esi, [ebp+NTFS.cur_index_buf] |
- | |
1257 | mov eax, [esi+14h] |
- | |
1258 | add eax, 10h |
- | |
1259 | cmp [ebp+NTFS.ntfs_cur_read], eax |
- | |
1260 | jae .readok1 |
- | |
1261 | add eax, 1FFh |
- | |
1262 | shr eax, 9 |
- | |
1263 | cmp eax, [ebp+NTFS.cur_index_size] |
- | |
1264 | ja @f |
- | |
1265 | .stc_ret: |
- | |
1266 | popad |
- | |
1267 | stc |
- | |
1268 | ret 4 |
- | |
1269 | @@: |
- | |
1270 | ; reallocate |
- | |
1271 | push eax |
- | |
1272 | stdcall kernel_free, [ebp+NTFS.cur_index_buf] |
- | |
1273 | pop eax |
- | |
1274 | mov [ebp+NTFS.cur_index_size], eax |
- | |
1275 | stdcall kernel_alloc, eax |
- | |
1276 | test eax, eax |
- | |
1277 | jnz @f |
- | |
1278 | and [ebp+NTFS.cur_index_size], 0 |
- | |
1279 | and [ebp+NTFS.cur_index_buf], 0 |
- | |
1280 | jmp .stc_ret |
- | |
1281 | @@: |
- | |
1282 | mov [ebp+NTFS.cur_index_buf], eax |
- | |
1283 | popad |
- | |
1284 | jmp .doit2 |
- | |
1285 | .readok1: |
1282 | mov esi, [ebp+NTFS.cur_index_buf] |
1286 | mov edx, [esi+8] ; subnode_size |
1283 | mov edx, [esi+indexRecordSize] |
1287 | shr edx, 9 |
1284 | shr edx, 9 |
1288 | cmp edx, [ebp+NTFS.cur_index_size] |
- | |
1289 | jbe .ok2 |
- | |
1290 | push esi edx |
- | |
1291 | stdcall kernel_alloc, edx |
- | |
1292 | pop edx esi |
- | |
1293 | test eax, eax |
1285 | cmp [ebp+NTFS.cur_index_size], edx |
1294 | jz .stc_ret |
1286 | jc .realloc |
1295 | mov edi, eax |
1287 | add esi, rootNode |
1296 | mov ecx, [ebp+NTFS.cur_index_size] |
1288 | mov eax, [esi+nodeRealSize] |
1297 | shl ecx, 9-2 |
- | |
1298 | rep movsd |
- | |
1299 | mov esi, eax |
1289 | add eax, rootNode |
1300 | mov [ebp+NTFS.cur_index_size], edx |
- | |
1301 | push esi edx |
- | |
1302 | stdcall kernel_free, [ebp+NTFS.cur_index_buf] |
1290 | cmp [ebp+NTFS.cur_read], eax |
1303 | pop edx esi |
- | |
1304 | mov [ebp+NTFS.cur_index_buf], esi |
- | |
1305 | .ok2: |
- | |
1306 | add esi, 10h |
1291 | jc .err |
1307 | mov edi, [esp+4] |
1292 | mov edi, [esp+4] |
1308 | ; edi -> name, esi -> current index data, edx = subnode size |
1293 | ; edi -> name, esi -> current index node, edx = subnode size |
1309 | .scanloop: |
1294 | .scanloop: |
1310 | add esi, [esi] |
1295 | add esi, [esi+indexOffset] |
1311 | .scanloopint: |
1296 | .scanloopint: |
1312 | test byte [esi+0Ch], 2 |
1297 | test byte [esi+indexFlags], 2 |
1313 | jnz .subnode |
1298 | jnz .subnode |
1314 | push esi |
1299 | push esi |
1315 | add esi, 0x52 |
1300 | movzx ecx, byte [esi+fileNameLength] |
1316 | movzx ecx, byte [esi-2] |
1301 | add esi, fileName |
1317 | push edi |
1302 | push edi |
1318 | @@: |
1303 | @@: |
1319 | lodsw |
1304 | lodsw |
1320 | call unichar_toupper |
1305 | call unichar_toupper |
Line 1331... | Line 1316... | ||
1331 | jz .found |
1316 | jz .found |
1332 | pop edi |
1317 | pop edi |
1333 | pop esi |
1318 | pop esi |
1334 | jb .subnode |
1319 | jb .subnode |
1335 | .scanloopcont: |
1320 | .scanloopcont: |
1336 | movzx eax, word [esi+8] |
1321 | movzx eax, word [esi+indexAllocatedSize] |
1337 | add esi, eax |
1322 | add esi, eax |
1338 | jmp .scanloopint |
1323 | jmp .scanloopint |
- | 1324 | ||
- | 1325 | .realloc: |
|
- | 1326 | mov edi, edx |
|
- | 1327 | stdcall kernel_alloc, [esi+indexRecordSize] |
|
- | 1328 | test eax, eax |
|
- | 1329 | jz .err |
|
- | 1330 | push [ebp+NTFS.cur_index_buf] |
|
- | 1331 | mov [ebp+NTFS.cur_index_buf], eax |
|
- | 1332 | call kernel_free |
|
- | 1333 | mov [ebp+NTFS.cur_index_size], edi |
|
- | 1334 | popad |
|
- | 1335 | jmp .doit2 |
|
- | 1336 | ||
- | 1337 | .notfound: |
|
- | 1338 | mov [esp+1Ch], esi |
|
- | 1339 | .err: |
|
- | 1340 | popad |
|
- | 1341 | stc |
|
- | 1342 | .ret: |
|
- | 1343 | ret 4 |
|
- | 1344 | ||
1339 | .slash: |
1345 | .slash: |
1340 | pop eax |
1346 | pop eax |
1341 | pop edi |
1347 | pop edi |
1342 | pop esi |
1348 | pop esi |
1343 | .subnode: |
1349 | .subnode: |
1344 | test byte [esi+0Ch], 1 |
1350 | test byte [esi+indexFlags], 1 |
1345 | jz .notfound |
1351 | jz .notfound |
1346 | movzx eax, word [esi+8] |
1352 | movzx eax, word [esi+indexAllocatedSize] |
1347 | mov eax, [esi+eax-8] |
1353 | mov eax, [esi+eax-8] |
1348 | imul eax, [ebp+NTFS.sectors_per_cluster] |
1354 | imul eax, [ebp+NTFS.sectors_per_cluster] |
1349 | mov [ebp+NTFS.ntfs_cur_offs], eax |
1355 | mov [ebp+NTFS.cur_offs], eax |
1350 | mov [ebp+NTFS.ntfs_cur_attr], 0xA0 ; $INDEX_ALLOCATION |
1356 | mov [ebp+NTFS.cur_attr], 0xA0 ; $INDEX_ALLOCATION |
1351 | mov [ebp+NTFS.ntfs_cur_size], edx |
1357 | mov [ebp+NTFS.cur_size], edx |
1352 | mov eax, [ebp+NTFS.cur_index_buf] |
1358 | mov eax, [ebp+NTFS.cur_index_buf] |
1353 | mov esi, eax |
1359 | mov esi, eax |
1354 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1360 | mov [ebp+NTFS.cur_buf], eax |
1355 | push edx |
- | |
1356 | call ntfs_read_attr |
1361 | call ntfs_read_attr.newAttribute |
1357 | pop edx |
- | |
1358 | mov eax, edx |
1362 | mov eax, edx |
1359 | shl eax, 9 |
1363 | shl eax, 9 |
1360 | cmp [ebp+NTFS.ntfs_cur_read], eax |
1364 | cmp [ebp+NTFS.cur_read], eax |
1361 | jnz .err |
1365 | jnz .err |
1362 | cmp dword [esi], 'INDX' |
1366 | cmp dword [esi], 'INDX' |
1363 | jnz .err |
1367 | jnz .err |
1364 | mov [ebp+NTFS.ntfs_cur_buf], esi |
1368 | mov [ebp+NTFS.cur_buf], esi |
1365 | mov ebx, esi |
1369 | mov ebx, esi |
1366 | call ntfs_restore_usa |
1370 | call ntfs_restore_usa |
1367 | jc .err |
1371 | jc .err |
1368 | add esi, 0x18 |
1372 | add esi, recordNode |
1369 | jmp .scanloop |
1373 | jmp .scanloop |
1370 | .notfound: |
- | |
1371 | mov [esp+1Ch], esi |
- | |
1372 | .err: |
1374 | |
1373 | popad |
- | |
1374 | stc |
- | |
1375 | ret 4 |
- | |
1376 | .found: |
1375 | .found: |
1377 | cmp byte [edi], 0 |
1376 | cmp byte [edi], 0 |
1378 | jz .done |
1377 | jz .done |
1379 | cmp byte [edi], '/' |
1378 | cmp byte [edi], '/' |
1380 | jz .next |
1379 | jz .next |
1381 | pop edi |
1380 | pop edi |
1382 | pop esi |
1381 | pop esi |
1383 | jmp .scanloopcont |
1382 | jmp .scanloopcont |
- | 1383 | ||
1384 | .done: |
1384 | .done: |
1385 | .next: |
1385 | .next: |
1386 | pop esi |
1386 | pop esi |
1387 | pop esi |
1387 | pop esi |
1388 | mov eax, [esi] |
1388 | mov eax, [esi] |
1389 | mov [ebp+NTFS.ntfs_cur_iRecord], eax |
1389 | mov [ebp+NTFS.cur_iRecord], eax |
1390 | mov [esp+1Ch], esi |
1390 | mov [esp+1Ch], esi |
1391 | mov [esp+4], edi |
1391 | mov [esp+4], edi |
1392 | popad |
1392 | popad |
1393 | inc esi |
1393 | inc esi |
1394 | cmp byte [esi-1], 0 |
1394 | cmp byte [esi-1], 0 |
1395 | jnz .doit2 |
1395 | jnz .doit2 |
1396 | cmp dword [esp+4], 0 |
1396 | cmp dword [esp+4], 0 |
1397 | jz @f |
1397 | jz .ret |
1398 | mov esi, [esp+4] |
1398 | mov esi, [esp+4] |
1399 | mov dword [esp+4], 0 |
1399 | mov dword [esp+4], 0 |
1400 | jmp .doit2 |
1400 | jmp .doit2 |
1401 | @@: |
- | |
1402 | ret 4 |
- | |
Line 1403... | Line 1401... | ||
1403 | 1401 | ||
1404 | ;---------------------------------------------------------------- |
1402 | ;---------------------------------------------------------------- |
1405 | ntfs_ReadFile: |
1403 | ntfs_ReadFile: |
1406 | cmp byte [esi], 0 |
1404 | cmp byte [esi], 0 |
1407 | jnz @f |
1405 | jnz @f |
1408 | or ebx, -1 |
1406 | or ebx, -1 |
1409 | movi eax, ERROR_ACCESS_DENIED |
1407 | movi eax, ERROR_ACCESS_DENIED |
- | 1408 | ret |
|
1410 | ret |
1409 | |
1411 | @@: |
1410 | @@: |
1412 | call ntfs_lock |
1411 | call ntfs_lock |
1413 | stdcall ntfs_find_lfn, [esp+4] |
1412 | stdcall ntfs_find_lfn, [esp+4] |
1414 | jnc .found |
1413 | jnc .found |
1415 | call ntfs_unlock |
1414 | call ntfs_unlock |
1416 | or ebx, -1 |
1415 | or ebx, -1 |
1417 | movi eax, ERROR_FILE_NOT_FOUND |
1416 | movi eax, ERROR_FILE_NOT_FOUND |
- | 1417 | ret |
|
1418 | ret |
1418 | |
1419 | .found: |
1419 | .found: |
1420 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 ; $DATA |
1420 | mov [ebp+NTFS.cur_attr], 0x80 ; $DATA |
1421 | and [ebp+NTFS.ntfs_cur_offs], 0 |
1421 | and [ebp+NTFS.cur_offs], 0 |
1422 | and [ebp+NTFS.ntfs_cur_size], 0 |
1422 | and [ebp+NTFS.cur_size], 0 |
1423 | call ntfs_read_attr |
1423 | call ntfs_read_attr |
1424 | jnc @f |
1424 | jnc @f |
1425 | call ntfs_unlock |
1425 | call ntfs_unlock |
1426 | or ebx, -1 |
1426 | or ebx, -1 |
1427 | movi eax, ERROR_ACCESS_DENIED |
1427 | movi eax, ERROR_ACCESS_DENIED |
- | 1428 | ret |
|
1428 | ret |
1429 | |
1429 | @@: |
1430 | @@: |
1430 | pushad |
1431 | pushad |
1431 | and dword [esp+10h], 0 |
1432 | and dword [esp+10h], 0 |
1432 | xor eax, eax |
1433 | xor eax, eax |
1433 | cmp dword [ebx+8], 0x200 |
1434 | cmp dword [ebx+8], 0x200 |
1434 | jb @f |
1435 | jb @f |
1435 | .eof0: |
1436 | .eof0: |
1436 | popad |
1437 | popad |
1437 | xor ebx, ebx |
1438 | xor ebx, ebx |
1438 | .eof: |
- | |
1439 | push ERROR_END_OF_FILE |
1439 | .eof: |
1440 | call ntfs_unlock |
1440 | call ntfs_unlock |
1441 | pop eax |
1441 | movi eax, ERROR_END_OF_FILE |
- | 1442 | ret |
|
1442 | ret |
1443 | |
1443 | @@: |
1444 | @@: |
1444 | mov ecx, [ebx+12] |
1445 | mov ecx, [ebx+12] |
1445 | mov edx, [ebx+16] |
1446 | mov edx, [ebx+16] |
1446 | mov eax, [ebx+4] |
1447 | mov eax, [ebx+4] |
1447 | test eax, 0x1FF |
1448 | test eax, 0x1FF |
1448 | jz .alignedstart |
1449 | jz .alignedstart |
1449 | push edx |
1450 | push edx |
1450 | mov edx, [ebx+8] |
1451 | mov edx, [ebx+8] |
1451 | shrd eax, edx, 9 |
1452 | shrd eax, edx, 9 |
1452 | pop edx |
1453 | pop edx |
1453 | mov [ebp+NTFS.ntfs_cur_offs], eax |
1454 | mov [ebp+NTFS.cur_offs], eax |
1454 | mov [ebp+NTFS.ntfs_cur_size], 1 |
1455 | mov [ebp+NTFS.cur_size], 1 |
1455 | lea eax, [ebp+NTFS.ntfs_bitmap_buf] |
1456 | lea eax, [ebp+NTFS.bitmap_buf] |
1456 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1457 | mov [ebp+NTFS.cur_buf], eax |
1457 | call ntfs_read_attr.continue |
1458 | call ntfs_read_attr.continue |
1458 | mov eax, [ebx+4] |
1459 | mov eax, [ebx+4] |
1459 | and eax, 0x1FF |
1460 | and eax, 0x1FF |
1460 | lea esi, [ebp+NTFS.ntfs_bitmap_buf+eax] |
1461 | lea esi, [ebp+NTFS.bitmap_buf+eax] |
1461 | sub eax, [ebp+NTFS.ntfs_cur_read] |
1462 | sub eax, [ebp+NTFS.cur_read] |
1462 | jae .eof0 |
1463 | jae .eof0 |
1463 | neg eax |
1464 | neg eax |
1464 | push ecx |
1465 | push ecx |
1465 | cmp ecx, eax |
1466 | cmp ecx, eax |
Line 1476... | Line 1477... | ||
1476 | .retok: |
1477 | .retok: |
1477 | popad |
1478 | popad |
1478 | call ntfs_unlock |
1479 | call ntfs_unlock |
1479 | xor eax, eax |
1480 | xor eax, eax |
1480 | ret |
1481 | ret |
- | 1482 | ||
1481 | @@: |
1483 | @@: |
1482 | cmp [ebp+NTFS.ntfs_cur_read], 0x200 |
1484 | cmp [ebp+NTFS.cur_read], 0x200 |
1483 | jz .alignedstart |
1485 | jz .alignedstart |
1484 | .eof_ebx: |
1486 | .eof_ebx: |
1485 | popad |
1487 | popad |
1486 | jmp .eof |
1488 | jmp .eof |
- | 1489 | ||
1487 | .alignedstart: |
1490 | .alignedstart: |
1488 | mov eax, [ebx+4] |
1491 | mov eax, [ebx+4] |
1489 | push edx |
1492 | push edx |
1490 | mov edx, [ebx+8] |
1493 | mov edx, [ebx+8] |
1491 | add eax, 511 |
1494 | add eax, 511 |
1492 | adc edx, 0 |
1495 | adc edx, 0 |
1493 | shrd eax, edx, 9 |
1496 | shrd eax, edx, 9 |
1494 | pop edx |
1497 | pop edx |
1495 | mov [ebp+NTFS.ntfs_cur_offs], eax |
1498 | mov [ebp+NTFS.cur_offs], eax |
1496 | mov [ebp+NTFS.ntfs_cur_buf], edx |
1499 | mov [ebp+NTFS.cur_buf], edx |
1497 | mov eax, ecx |
1500 | mov eax, ecx |
1498 | shr eax, 9 |
1501 | shr eax, 9 |
1499 | mov [ebp+NTFS.ntfs_cur_size], eax |
1502 | mov [ebp+NTFS.cur_size], eax |
1500 | add eax, [ebp+NTFS.ntfs_cur_offs] |
1503 | add eax, [ebp+NTFS.cur_offs] |
1501 | push eax |
1504 | push eax |
1502 | call ntfs_read_attr.continue |
1505 | call ntfs_read_attr.continue |
1503 | pop [ebp+NTFS.ntfs_cur_offs] |
1506 | pop [ebp+NTFS.cur_offs] |
1504 | mov eax, [ebp+NTFS.ntfs_cur_read] |
1507 | mov eax, [ebp+NTFS.cur_read] |
1505 | add [esp+10h], eax |
1508 | add [esp+10h], eax |
1506 | mov eax, ecx |
1509 | mov eax, ecx |
1507 | and eax, not 0x1FF |
1510 | and eax, not 0x1FF |
1508 | cmp [ebp+NTFS.ntfs_cur_read], eax |
1511 | cmp [ebp+NTFS.cur_read], eax |
1509 | jnz .eof_ebx |
1512 | jnz .eof_ebx |
1510 | and ecx, 0x1FF |
1513 | and ecx, 0x1FF |
1511 | jz .retok |
1514 | jz .retok |
1512 | add edx, [ebp+NTFS.ntfs_cur_read] |
1515 | add edx, [ebp+NTFS.cur_read] |
1513 | mov [ebp+NTFS.ntfs_cur_size], 1 |
1516 | mov [ebp+NTFS.cur_size], 1 |
1514 | lea eax, [ebp+NTFS.ntfs_bitmap_buf] |
1517 | lea eax, [ebp+NTFS.bitmap_buf] |
1515 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1518 | mov [ebp+NTFS.cur_buf], eax |
1516 | call ntfs_read_attr.continue |
1519 | call ntfs_read_attr.continue |
1517 | cmp [ebp+NTFS.ntfs_cur_read], ecx |
1520 | cmp [ebp+NTFS.cur_read], ecx |
1518 | jb @f |
1521 | jb @f |
1519 | mov [ebp+NTFS.ntfs_cur_read], ecx |
1522 | mov [ebp+NTFS.cur_read], ecx |
1520 | @@: |
1523 | @@: |
1521 | xchg ecx, [ebp+NTFS.ntfs_cur_read] |
1524 | xchg ecx, [ebp+NTFS.cur_read] |
1522 | push ecx |
1525 | push ecx |
1523 | mov edi, edx |
1526 | mov edi, edx |
1524 | lea esi, [ebp+NTFS.ntfs_bitmap_buf] |
1527 | lea esi, [ebp+NTFS.bitmap_buf] |
1525 | add [esp+10h+4], ecx |
1528 | add [esp+10h+4], ecx |
1526 | rep movsb |
1529 | rep movsb |
1527 | pop ecx |
1530 | pop ecx |
1528 | xor eax, eax |
1531 | xor eax, eax |
1529 | cmp ecx, [ebp+NTFS.ntfs_cur_read] |
1532 | cmp ecx, [ebp+NTFS.cur_read] |
1530 | jz @f |
1533 | jz @f |
1531 | mov al, ERROR_END_OF_FILE |
1534 | mov al, ERROR_END_OF_FILE |
1532 | @@: |
1535 | @@: |
1533 | mov [esp+1Ch], eax |
1536 | mov [esp+1Ch], eax |
1534 | call ntfs_unlock |
1537 | call ntfs_unlock |
Line 1536... | Line 1539... | ||
1536 | ret |
1539 | ret |
Line 1537... | Line 1540... | ||
1537 | 1540 | ||
1538 | ;---------------------------------------------------------------- |
1541 | ;---------------------------------------------------------------- |
1539 | ntfs_ReadFolder: |
1542 | ntfs_ReadFolder: |
1540 | call ntfs_lock |
1543 | call ntfs_lock |
1541 | mov eax, 5 ; root cluster |
1544 | mov [ebp+NTFS.cur_iRecord], 5 ; root directory |
1542 | cmp byte [esi], 0 |
1545 | cmp byte [esi], 0 |
1543 | jz .doit |
1546 | jz @f |
1544 | stdcall ntfs_find_lfn, [esp+4] |
- | |
1545 | jnc .doit2 |
- | |
1546 | .notfound: |
- | |
1547 | or ebx, -1 |
- | |
1548 | push ERROR_FILE_NOT_FOUND |
- | |
1549 | .pop_ret: |
1547 | stdcall ntfs_find_lfn, [esp+4] |
1550 | call ntfs_unlock |
- | |
1551 | pop eax |
- | |
1552 | ret |
1548 | jc ntfsNotFound |
1553 | .doit: |
- | |
1554 | mov [ebp+NTFS.ntfs_cur_iRecord], eax |
- | |
1555 | .doit2: |
1549 | @@: |
1556 | mov [ebp+NTFS.ntfs_cur_attr], 0x10 ; $STANDARD_INFORMATION |
1550 | mov [ebp+NTFS.cur_attr], 0x10 ; $STANDARD_INFORMATION |
1557 | and [ebp+NTFS.ntfs_cur_offs], 0 |
1551 | and [ebp+NTFS.cur_offs], 0 |
1558 | mov [ebp+NTFS.ntfs_cur_size], 1 |
1552 | mov [ebp+NTFS.cur_size], 1 |
1559 | lea eax, [ebp+NTFS.ntfs_bitmap_buf] |
1553 | lea eax, [ebp+NTFS.bitmap_buf] |
1560 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1554 | mov [ebp+NTFS.cur_buf], eax |
1561 | call ntfs_read_attr |
1555 | call ntfs_read_attr |
1562 | jc .notfound |
1556 | jc ntfsFail |
1563 | mov [ebp+NTFS.ntfs_cur_attr], 0x90 ; $INDEX_ROOT |
1557 | mov [ebp+NTFS.cur_attr], 0x90 ; $INDEX_ROOT |
1564 | and [ebp+NTFS.ntfs_cur_offs], 0 |
1558 | .doit: |
1565 | mov eax, [ebp+NTFS.cur_index_size] |
1559 | mov eax, [ebp+NTFS.cur_index_size] |
1566 | mov [ebp+NTFS.ntfs_cur_size], eax |
1560 | mov [ebp+NTFS.cur_size], eax |
1567 | mov eax, [ebp+NTFS.cur_index_buf] |
1561 | mov eax, [ebp+NTFS.cur_index_buf] |
1568 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1562 | mov [ebp+NTFS.cur_buf], eax |
1569 | call ntfs_read_attr |
- | |
1570 | jnc .ok |
- | |
1571 | test eax, eax |
1563 | call ntfs_read_attr.newAttribute |
1572 | jz .notfound |
- | |
1573 | or ebx, -1 |
- | |
1574 | push ERROR_DEVICE |
- | |
1575 | jmp .pop_ret |
- | |
1576 | .ok: |
1564 | jc ntfsFail |
1577 | cmp [ebp+NTFS.ntfs_cur_read], 0x20 |
- | |
1578 | jae @f |
- | |
1579 | or ebx, -1 |
- | |
1580 | .fserr: |
- | |
1581 | push ERROR_FAT_TABLE |
1565 | cmp [ebp+NTFS.cur_read], 0x20 |
1582 | jmp .pop_ret |
- | |
1583 | @@: |
1566 | jc ntfsFail |
1584 | pushad |
1567 | pushad |
1585 | mov esi, [ebp+NTFS.cur_index_buf] |
- | |
1586 | mov eax, [esi+14h] |
- | |
1587 | add eax, 10h |
- | |
1588 | cmp [ebp+NTFS.ntfs_cur_read], eax |
- | |
1589 | jae .readok1 |
- | |
1590 | add eax, 1FFh |
- | |
1591 | shr eax, 9 |
- | |
1592 | cmp eax, [ebp+NTFS.cur_index_size] |
- | |
1593 | ja @f |
- | |
1594 | popad |
- | |
1595 | jmp .fserr |
- | |
1596 | @@: |
- | |
1597 | ; reallocate |
- | |
1598 | push eax |
- | |
1599 | stdcall kernel_free, [ebp+NTFS.cur_index_buf] |
- | |
1600 | pop eax |
- | |
1601 | mov [ebp+NTFS.cur_index_size], eax |
- | |
1602 | stdcall kernel_alloc, eax |
- | |
1603 | test eax, eax |
- | |
1604 | jnz @f |
- | |
1605 | and [ebp+NTFS.cur_index_size], 0 |
- | |
1606 | and [ebp+NTFS.cur_index_buf], 0 |
- | |
1607 | .nomem: |
- | |
1608 | call ntfs_unlock |
- | |
1609 | popad |
- | |
1610 | or ebx, -1 |
- | |
1611 | movi eax, ERROR_OUT_OF_MEMORY |
- | |
1612 | ret |
- | |
1613 | @@: |
- | |
1614 | mov [ebp+NTFS.cur_index_buf], eax |
- | |
1615 | popad |
- | |
1616 | jmp .doit2 |
- | |
1617 | .readok1: |
1568 | mov esi, [ebp+NTFS.cur_index_buf] |
1618 | mov edx, [esi+8] ; subnode_size |
1569 | mov edx, [esi+indexRecordSize] |
- | 1570 | shr edx, 9 |
|
- | 1571 | cmp [ebp+NTFS.cur_index_size], edx |
|
1619 | shr edx, 9 |
1572 | jc .realloc |
1620 | mov [ebp+NTFS.cur_subnode_size], edx |
- | |
1621 | cmp edx, [ebp+NTFS.cur_index_size] |
- | |
1622 | jbe .ok2 |
- | |
1623 | push esi edx |
- | |
1624 | stdcall kernel_alloc, edx |
- | |
1625 | pop edx esi |
- | |
1626 | test eax, eax |
- | |
1627 | jz .nomem |
1573 | mov [ebp+NTFS.cur_subnode_size], edx |
1628 | mov edi, eax |
1574 | add esi, rootNode |
1629 | mov ecx, [ebp+NTFS.cur_index_size] |
1575 | mov eax, [esi+nodeRealSize] |
1630 | shl ecx, 9-2 |
- | |
1631 | rep movsd |
- | |
1632 | mov esi, eax |
1576 | add eax, rootNode |
1633 | mov [ebp+NTFS.cur_index_size], edx |
- | |
1634 | stdcall kernel_free, [ebp+NTFS.cur_index_buf] |
- | |
1635 | mov [ebp+NTFS.cur_index_buf], esi |
- | |
1636 | .ok2: |
1577 | cmp [ebp+NTFS.cur_read], eax |
1637 | add esi, 10h |
1578 | jc .err |
1638 | mov edx, [ebx+16] |
1579 | mov edx, [ebx+16] |
1639 | push dword [ebx+8] ; read ANSI/UNICODE name |
1580 | push dword [ebx+8] ; read ANSI/UNICODE name |
1640 | ; init header |
1581 | ; init header |
1641 | mov edi, edx |
1582 | mov edi, edx |
Line 1648... | Line 1589... | ||
1648 | push edx |
1589 | push edx |
1649 | mov edx, esp |
1590 | mov edx, esp |
1650 | ; edi -> BDFE, esi -> current index data, ebx = first wanted block, |
1591 | ; edi -> BDFE, esi -> current index data, ebx = first wanted block, |
1651 | ; ecx = number of blocks to read |
1592 | ; ecx = number of blocks to read |
1652 | ; edx -> parameters block: dd |
1593 | ; edx -> parameters block: dd |
1653 | cmp [ebp+NTFS.ntfs_cur_iRecord], 5 |
1594 | cmp [ebp+NTFS.cur_iRecord], 5 |
1654 | jz .skip_specials |
1595 | jz .skip_specials |
1655 | ; dot and dotdot entries |
1596 | ; dot and dotdot entries |
1656 | push esi |
1597 | push esi |
1657 | xor esi, esi |
1598 | xor esi, esi |
1658 | call .add_special_entry |
1599 | call .add_special_entry |
1659 | inc esi |
1600 | inc esi |
1660 | call .add_special_entry |
1601 | call .add_special_entry |
1661 | pop esi |
1602 | pop esi |
1662 | .skip_specials: |
1603 | .skip_specials: |
1663 | ; at first, dump index root |
1604 | ; at first, dump index root |
1664 | add esi, [esi] |
1605 | add esi, [esi+indexOffset] |
1665 | .dump_root: |
1606 | .dump_root: |
1666 | test byte [esi+0Ch], 2 |
1607 | test byte [esi+indexFlags], 2 |
1667 | jnz .dump_root_done |
1608 | jnz .dump_root_done |
1668 | call .add_entry |
1609 | call .add_entry |
1669 | movzx eax, word [esi+8] |
1610 | movzx eax, word [esi+indexAllocatedSize] |
1670 | add esi, eax |
1611 | add esi, eax |
1671 | jmp .dump_root |
1612 | jmp .dump_root |
- | 1613 | ||
- | 1614 | .realloc: |
|
- | 1615 | mov edi, edx |
|
- | 1616 | stdcall kernel_alloc, [esi+indexRecordSize] |
|
- | 1617 | test eax, eax |
|
- | 1618 | jz .err |
|
- | 1619 | push [ebp+NTFS.cur_index_buf] |
|
- | 1620 | mov [ebp+NTFS.cur_index_buf], eax |
|
- | 1621 | call kernel_free |
|
- | 1622 | mov [ebp+NTFS.cur_index_size], edi |
|
- | 1623 | popad |
|
- | 1624 | jmp .doit |
|
- | 1625 | ||
- | 1626 | .err: |
|
- | 1627 | popad |
|
- | 1628 | jmp ntfsFail |
|
- | 1629 | ||
1672 | .dump_root_done: |
1630 | .dump_root_done: |
1673 | ; now dump all subnodes |
1631 | ; now dump all subnodes |
1674 | push ecx edi |
1632 | push ecx edi |
1675 | lea edi, [ebp+NTFS.ntfs_bitmap_buf] |
1633 | lea edi, [ebp+NTFS.bitmap_buf] |
1676 | mov [ebp+NTFS.ntfs_cur_buf], edi |
1634 | mov [ebp+NTFS.cur_buf], edi |
1677 | mov ecx, 0x400/4 |
1635 | mov ecx, 0x400/4 |
1678 | xor eax, eax |
1636 | xor eax, eax |
1679 | rep stosd |
1637 | rep stosd |
1680 | mov [ebp+NTFS.ntfs_cur_attr], 0xB0 ; $BITMAP |
1638 | mov [ebp+NTFS.cur_attr], 0xB0 ; $BITMAP |
1681 | and [ebp+NTFS.ntfs_cur_offs], 0 |
1639 | and [ebp+NTFS.cur_offs], 0 |
1682 | mov [ebp+NTFS.ntfs_cur_size], 2 |
1640 | mov [ebp+NTFS.cur_size], 2 |
1683 | call ntfs_read_attr |
1641 | call ntfs_read_attr.newAttribute |
1684 | pop edi ecx |
1642 | pop edi ecx |
1685 | push 0 ; save offset in $BITMAP attribute |
1643 | push 0 ; save offset in $BITMAP attribute |
1686 | and [ebp+NTFS.ntfs_cur_offs], 0 |
1644 | and [ebp+NTFS.cur_offs], 0 |
1687 | .dumploop: |
1645 | .dumploop: |
1688 | mov [ebp+NTFS.ntfs_cur_attr], 0xA0 |
1646 | mov [ebp+NTFS.cur_attr], 0xA0 |
1689 | mov eax, [ebp+NTFS.cur_subnode_size] |
1647 | mov eax, [ebp+NTFS.cur_subnode_size] |
1690 | mov [ebp+NTFS.ntfs_cur_size], eax |
1648 | mov [ebp+NTFS.cur_size], eax |
1691 | mov eax, [ebp+NTFS.cur_index_buf] |
1649 | mov esi, [ebp+NTFS.cur_index_buf] |
1692 | mov esi, eax |
- | |
1693 | mov [ebp+NTFS.ntfs_cur_buf], eax |
1650 | mov [ebp+NTFS.cur_buf], esi |
1694 | push [ebp+NTFS.ntfs_cur_offs] |
1651 | mov eax, [ebp+NTFS.cur_offs] |
1695 | mov eax, [ebp+NTFS.ntfs_cur_offs] |
1652 | push eax |
1696 | imul eax, [ebp+NTFS.cur_subnode_size] |
1653 | imul eax, [ebp+NTFS.cur_subnode_size] |
1697 | mov [ebp+NTFS.ntfs_cur_offs], eax |
1654 | mov [ebp+NTFS.cur_offs], eax |
1698 | call ntfs_read_attr |
1655 | call ntfs_read_attr.newAttribute |
1699 | pop [ebp+NTFS.ntfs_cur_offs] |
1656 | pop [ebp+NTFS.cur_offs] |
1700 | mov eax, [ebp+NTFS.cur_subnode_size] |
1657 | mov eax, [ebp+NTFS.cur_subnode_size] |
1701 | shl eax, 9 |
1658 | shl eax, 9 |
1702 | cmp [ebp+NTFS.ntfs_cur_read], eax |
1659 | cmp [ebp+NTFS.cur_read], eax |
1703 | jnz .done |
1660 | jnz .done |
1704 | push eax |
1661 | push eax |
1705 | mov eax, [ebp+NTFS.ntfs_cur_offs] |
1662 | mov eax, [ebp+NTFS.cur_offs] |
1706 | and eax, 0x400*8-1 |
1663 | and eax, 0x400*8-1 |
1707 | bt dword [ebp+NTFS.ntfs_bitmap_buf], eax |
1664 | bt dword [ebp+NTFS.bitmap_buf], eax |
1708 | pop eax |
1665 | pop eax |
1709 | jnc .dump_subnode_done |
1666 | jnc .dump_subnode_done |
1710 | cmp dword [esi], 'INDX' |
1667 | cmp dword [esi], 'INDX' |
1711 | jnz .dump_subnode_done |
1668 | jnz .dump_subnode_done |
1712 | push ebx |
1669 | push ebx |
1713 | mov ebx, esi |
1670 | mov ebx, esi |
1714 | call ntfs_restore_usa |
1671 | call ntfs_restore_usa |
1715 | pop ebx |
1672 | pop ebx |
1716 | jc .dump_subnode_done |
1673 | jc .dump_subnode_done |
1717 | add esi, 0x18 |
1674 | add esi, recordNode |
1718 | add esi, [esi] |
1675 | add esi, [esi+indexOffset] |
1719 | .dump_subnode: |
1676 | .dump_subnode: |
1720 | test byte [esi+0Ch], 2 |
1677 | test byte [esi+indexFlags], 2 |
1721 | jnz .dump_subnode_done |
1678 | jnz .dump_subnode_done |
1722 | call .add_entry |
1679 | call .add_entry |
1723 | movzx eax, word [esi+8] |
1680 | movzx eax, word [esi+indexAllocatedSize] |
1724 | add esi, eax |
1681 | add esi, eax |
1725 | jmp .dump_subnode |
1682 | jmp .dump_subnode |
- | 1683 | ||
1726 | .dump_subnode_done: |
1684 | .dump_subnode_done: |
1727 | inc [ebp+NTFS.ntfs_cur_offs] |
1685 | inc [ebp+NTFS.cur_offs] |
1728 | test [ebp+NTFS.ntfs_cur_offs], 0x400*8-1 |
1686 | test [ebp+NTFS.cur_offs], 0x400*8-1 |
1729 | jnz .dumploop |
1687 | jnz .dumploop |
1730 | mov [ebp+NTFS.ntfs_cur_attr], 0xB0 |
1688 | mov [ebp+NTFS.cur_attr], 0xB0 |
1731 | push ecx edi |
1689 | push ecx edi |
1732 | lea edi, [ebp+NTFS.ntfs_bitmap_buf] |
1690 | lea edi, [ebp+NTFS.bitmap_buf] |
1733 | mov [ebp+NTFS.ntfs_cur_buf], edi |
1691 | mov [ebp+NTFS.cur_buf], edi |
1734 | mov ecx, 0x400/4 |
1692 | mov ecx, 0x400/4 |
1735 | xor eax, eax |
1693 | xor eax, eax |
1736 | rep stosd |
1694 | rep stosd |
1737 | pop edi ecx |
1695 | pop edi ecx |
1738 | pop eax |
1696 | pop eax |
1739 | push [ebp+NTFS.ntfs_cur_offs] |
1697 | push [ebp+NTFS.cur_offs] |
1740 | inc eax |
1698 | inc eax |
1741 | mov [ebp+NTFS.ntfs_cur_offs], eax |
1699 | mov [ebp+NTFS.cur_offs], eax |
1742 | mov [ebp+NTFS.ntfs_cur_size], 2 |
1700 | mov [ebp+NTFS.cur_size], 2 |
1743 | push eax |
1701 | push eax |
1744 | call ntfs_read_attr |
1702 | call ntfs_read_attr.newAttribute |
1745 | pop eax |
1703 | pop eax |
1746 | pop [ebp+NTFS.ntfs_cur_offs] |
1704 | pop [ebp+NTFS.cur_offs] |
1747 | push eax |
1705 | push eax |
1748 | jmp .dumploop |
1706 | jmp .dumploop |
- | 1707 | ||
1749 | .done: |
1708 | .done: |
1750 | pop eax |
1709 | pop eax |
1751 | pop edx |
1710 | pop edx |
1752 | mov ebx, [edx+4] |
1711 | mov ebx, [edx+4] |
1753 | pop edx |
1712 | pop edx |
Line 1770... | Line 1729... | ||
1770 | dec ecx |
1729 | dec ecx |
1771 | js .ret |
1730 | js .ret |
1772 | inc dword [eax+4] ; new file block copied |
1731 | inc dword [eax+4] ; new file block copied |
1773 | mov eax, [edx+4] |
1732 | mov eax, [edx+4] |
1774 | mov [edi+4], eax |
1733 | mov [edi+4], eax |
1775 | ; mov eax, dword [ntfs_bitmap_buf+0x20] |
- | |
1776 | ; or al, 0x10 |
- | |
1777 | mov eax, 0x10 |
1734 | mov eax, 0x10 |
1778 | stosd |
1735 | stosd |
1779 | scasd |
1736 | scasd |
1780 | push edx |
1737 | push edx |
1781 | mov eax, dword [ebp+NTFS.ntfs_bitmap_buf] |
1738 | mov eax, dword [ebp+NTFS.bitmap_buf] |
1782 | mov edx, dword [ebp+NTFS.ntfs_bitmap_buf+4] |
1739 | mov edx, dword [ebp+NTFS.bitmap_buf+4] |
1783 | call ntfs_datetime_to_bdfe |
1740 | call ntfs_datetime_to_bdfe |
1784 | mov eax, dword [ebp+NTFS.ntfs_bitmap_buf+0x18] |
1741 | mov eax, dword [ebp+NTFS.bitmap_buf+0x18] |
1785 | mov edx, dword [ebp+NTFS.ntfs_bitmap_buf+0x1C] |
1742 | mov edx, dword [ebp+NTFS.bitmap_buf+0x1C] |
1786 | call ntfs_datetime_to_bdfe |
1743 | call ntfs_datetime_to_bdfe |
1787 | mov eax, dword [ebp+NTFS.ntfs_bitmap_buf+8] |
1744 | mov eax, dword [ebp+NTFS.bitmap_buf+8] |
1788 | mov edx, dword [ebp+NTFS.ntfs_bitmap_buf+0xC] |
1745 | mov edx, dword [ebp+NTFS.bitmap_buf+0xC] |
1789 | call ntfs_datetime_to_bdfe |
1746 | call ntfs_datetime_to_bdfe |
1790 | pop edx |
1747 | pop edx |
1791 | xor eax, eax |
1748 | xor eax, eax |
1792 | stosd |
1749 | stosd |
1793 | stosd |
1750 | stosd |
Line 1801... | Line 1758... | ||
1801 | xor eax, eax |
1758 | xor eax, eax |
1802 | stosw |
1759 | stosw |
1803 | pop edi |
1760 | pop edi |
1804 | add edi, 520 |
1761 | add edi, 520 |
1805 | ret |
1762 | ret |
- | 1763 | ||
1806 | @@: |
1764 | @@: |
1807 | rep stosb |
1765 | rep stosb |
1808 | pop ecx |
1766 | pop ecx |
1809 | xor eax, eax |
1767 | xor eax, eax |
1810 | stosb |
1768 | stosb |
Line 1813... | Line 1771... | ||
1813 | .ret: |
1771 | .ret: |
1814 | ret |
1772 | ret |
Line 1815... | Line 1773... | ||
1815 | 1773 | ||
1816 | .add_entry: |
1774 | .add_entry: |
1817 | ; do not return DOS 8.3 names |
1775 | ; do not return DOS 8.3 names |
1818 | cmp byte [esi+0x51], 2 |
1776 | cmp byte [esi+namespace], 2 |
1819 | jz .ret |
1777 | jz .ret |
1820 | ; do not return system files |
1778 | ; do not return system files |
1821 | ; ... note that there will be no bad effects if system files also were reported ... |
1779 | ; ... note that there will be no bad effects if system files also were reported ... |
1822 | cmp dword [esi], 0x10 |
1780 | cmp dword [esi+fileRecordReference], 0x10 |
1823 | jb .ret |
1781 | jb .ret |
1824 | mov eax, [edx] |
1782 | mov eax, [edx] |
1825 | inc dword [eax+8] ; new file found |
1783 | inc dword [eax+8] ; new file found |
1826 | dec ebx |
1784 | dec ebx |
Line 1829... | Line 1787... | ||
1829 | js .ret |
1787 | js .ret |
1830 | inc dword [eax+4] ; new file block copied |
1788 | inc dword [eax+4] ; new file block copied |
1831 | mov eax, [edx+4] ; flags |
1789 | mov eax, [edx+4] ; flags |
1832 | call ntfs_direntry_to_bdfe |
1790 | call ntfs_direntry_to_bdfe |
1833 | push ecx esi edi |
1791 | push ecx esi edi |
1834 | movzx ecx, byte [esi+0x50] |
1792 | movzx ecx, byte [esi+fileNameLength] |
1835 | add esi, 0x52 |
1793 | add esi, fileName |
1836 | test byte [edi-0x24], 1 |
1794 | test byte [edi-0x24], 1 |
1837 | jz .ansi |
1795 | jz .ansi |
1838 | shr ecx, 1 |
1796 | shr ecx, 1 |
1839 | rep movsd |
1797 | rep movsd |
1840 | adc ecx, ecx |
1798 | adc ecx, ecx |
Line 1842... | Line 1800... | ||
1842 | and word [edi], 0 |
1800 | and word [edi], 0 |
1843 | pop edi |
1801 | pop edi |
1844 | add edi, 520 |
1802 | add edi, 520 |
1845 | pop esi ecx |
1803 | pop esi ecx |
1846 | ret |
1804 | ret |
- | 1805 | ||
1847 | .ansi: |
1806 | .ansi: |
1848 | jecxz .skip |
1807 | jecxz .skip |
1849 | @@: |
1808 | @@: |
1850 | lodsw |
1809 | lodsw |
1851 | call uni2ansi_char |
1810 | call uni2ansi_char |
Line 1859... | Line 1818... | ||
1859 | pop esi ecx |
1818 | pop esi ecx |
1860 | ret |
1819 | ret |
Line 1861... | Line 1820... | ||
1861 | 1820 | ||
1862 | ntfs_direntry_to_bdfe: |
1821 | ntfs_direntry_to_bdfe: |
1863 | mov [edi+4], eax ; ANSI/UNICODE name |
1822 | mov [edi+4], eax ; ANSI/UNICODE name |
1864 | mov eax, [esi+48h] |
1823 | mov eax, [esi+fileFlags] |
1865 | test eax, 0x10000000 |
1824 | test eax, 0x10000000 |
1866 | jz @f |
1825 | jz @f |
1867 | and eax, not 0x10000000 |
1826 | and eax, not 0x10000000 |
1868 | or al, 0x10 |
1827 | or al, 0x10 |
1869 | @@: |
1828 | @@: |
1870 | stosd |
1829 | stosd |
1871 | scasd |
1830 | scasd |
1872 | push edx |
1831 | push edx |
1873 | mov eax, [esi+0x18] |
1832 | mov eax, [esi+fileCreated] |
1874 | mov edx, [esi+0x1C] |
1833 | mov edx, [esi+fileCreated+4] |
1875 | call ntfs_datetime_to_bdfe |
1834 | call ntfs_datetime_to_bdfe |
1876 | mov eax, [esi+0x30] |
1835 | mov eax, [esi+fileAccessed] |
1877 | mov edx, [esi+0x34] |
1836 | mov edx, [esi+fileAccessed+4] |
1878 | call ntfs_datetime_to_bdfe |
1837 | call ntfs_datetime_to_bdfe |
1879 | mov eax, [esi+0x20] |
1838 | mov eax, [esi+fileModified] |
1880 | mov edx, [esi+0x24] |
1839 | mov edx, [esi+fileModified+4] |
1881 | call ntfs_datetime_to_bdfe |
1840 | call ntfs_datetime_to_bdfe |
1882 | pop edx |
1841 | pop edx |
1883 | mov eax, [esi+0x40] |
1842 | mov eax, [esi+fileRealSize] |
1884 | stosd |
1843 | stosd |
1885 | mov eax, [esi+0x44] |
1844 | mov eax, [esi+fileRealSize+4] |
1886 | stosd |
1845 | stosd |
Line 1887... | Line 1846... | ||
1887 | ret |
1846 | ret |
1888 | - | ||
1889 | iglobal |
- | |
1890 | _24 dd 24 |
- | |
1891 | _60 dd 60 |
- | |
1892 | _10000000 dd 10000000 |
- | |
1893 | days400year dd 365*400+100-4+1 |
- | |
1894 | days100year dd 365*100+25-1 |
- | |
1895 | days4year dd 365*4+1 |
1847 | |
1896 | days1year dd 365 |
1848 | iglobal |
1897 | months dd 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 |
- | |
1898 | months2 dd 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 |
- | |
1899 | _400 dd 400 |
1849 | months db 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 |
Line 1900... | Line 1850... | ||
1900 | _100 dd 100 |
1850 | months2 db 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 |
1901 | endg |
1851 | endg |
1902 | 1852 | ||
- | 1853 | ntfs_datetime_to_bdfe: |
|
1903 | ntfs_datetime_to_bdfe: |
1854 | ; edx:eax = number of 100-nanosecond intervals since January 1, 1601, in UTC |
1904 | ; edx:eax = number of 100-nanosecond intervals since January 1, 1601, in UTC |
1855 | push ebx ecx |
1905 | push eax |
1856 | mov ebx, eax |
1906 | mov eax, edx |
1857 | mov eax, edx |
1907 | xor edx, edx |
1858 | xor edx, edx |
1908 | div [_10000000] |
1859 | mov ecx, 10000000 |
1909 | xchg eax, [esp] |
1860 | div ecx |
1910 | div [_10000000] |
- | |
1911 | pop edx |
- | |
1912 | .sec: |
1861 | xchg eax, ebx |
1913 | ; edx:eax = number of seconds since January 1, 1601 |
1862 | div ecx |
- | 1863 | .forEXT: |
|
1914 | push eax |
1864 | xchg eax, ebx |
1915 | mov eax, edx |
1865 | xor edx, edx |
1916 | xor edx, edx |
1866 | mov ecx, 60 |
1917 | div [_60] |
1867 | div ecx |
1918 | xchg eax, [esp] |
1868 | xchg eax, ebx |
1919 | div [_60] |
1869 | div ecx |
1920 | mov [edi], dl |
1870 | mov [edi], dl |
1921 | pop edx |
1871 | mov edx, ebx |
1922 | ; edx:eax = number of minutes |
1872 | ; edx:eax = number of minutes |
1923 | div [_60] |
1873 | div ecx |
1924 | mov [edi+1], dl |
1874 | mov [edi+1], dl |
1925 | ; eax = number of hours (note that 2^64/(10^7*60*60) < 2^32) |
1875 | ; eax = number of hours |
1926 | xor edx, edx |
1876 | xor edx, edx |
1927 | div [_24] |
1877 | mov cl, 24 |
1928 | mov [edi+2], dl |
1878 | div ecx |
1929 | mov [edi+3], byte 0 |
- | |
1930 | ; eax = number of days since January 1, 1601 |
1879 | mov [edi+2], dx |
1931 | xor edx, edx |
1880 | ; eax = number of days since January 1, 1601 |
1932 | div [days400year] |
1881 | xor edx, edx |
1933 | imul eax, 400 |
1882 | mov cx, 365 |
1934 | add eax, 1601 |
1883 | div ecx |
1935 | mov [edi+6], ax |
1884 | mov ebx, eax |
1936 | mov eax, edx |
1885 | add ebx, 1601 |
1937 | xor edx, edx |
- | |
1938 | div [days100year] |
1886 | shr eax, 2 |
1939 | cmp al, 4 |
- | |
1940 | jnz @f |
- | |
1941 | dec eax |
1887 | sub edx, eax |
1942 | add edx, [days100year] |
1888 | mov cl, 25 |
1943 | @@: |
1889 | div cl |
1944 | imul eax, 100 |
1890 | xor ah, ah |
1945 | add [edi+6], ax |
- | |
1946 | mov eax, edx |
1891 | add edx, eax |
1947 | xor edx, edx |
- | |
1948 | div [days4year] |
1892 | shr eax, 2 |
1949 | shl eax, 2 |
1893 | sub edx, eax |
1950 | add [edi+6], ax |
- | |
1951 | mov eax, edx |
1894 | jns @f |
1952 | xor edx, edx |
1895 | dec ebx |
1953 | div [days1year] |
1896 | add edx, 365 |
1954 | cmp al, 4 |
- | |
1955 | jnz @f |
1897 | test bl, 3 |
1956 | dec eax |
- | |
1957 | add edx, [days1year] |
- | |
1958 | @@: |
- | |
1959 | add [edi+6], ax |
- | |
1960 | push esi edx |
- | |
1961 | mov esi, months |
- | |
1962 | movzx eax, word [edi+6] |
- | |
1963 | test al, 3 |
- | |
1964 | jnz .noleap |
- | |
1965 | xor edx, edx |
- | |
1966 | push eax |
- | |
1967 | div [_400] |
- | |
1968 | pop eax |
- | |
1969 | test edx, edx |
- | |
1970 | jz .leap |
- | |
1971 | xor edx, edx |
- | |
1972 | div [_100] |
- | |
1973 | test edx, edx |
- | |
1974 | jz .noleap |
- | |
1975 | .leap: |
- | |
1976 | mov esi, months2 |
1898 | jnz @f |
- | 1899 | inc edx |
|
- | 1900 | @@: |
|
1977 | .noleap: |
1901 | xor eax, eax |
- | 1902 | mov ecx, months-1 |
|
1978 | pop edx |
1903 | test bl, 3 |
1979 | xor eax, eax |
- | |
1980 | inc eax |
1904 | jnz @f |
1981 | @@: |
- | |
1982 | sub edx, [esi] |
1905 | add ecx, 12 |
- | 1906 | @@: |
|
1983 | jb @f |
1907 | inc ecx |
1984 | add esi, 4 |
- | |
1985 | inc eax |
1908 | inc eax |
1986 | jmp @b |
1909 | sub dl, [ecx] |
- | 1910 | jnc @b |
|
1987 | @@: |
1911 | dec dh |
1988 | add edx, [esi] |
1912 | jns @b |
1989 | pop esi |
1913 | add dl, [ecx] |
- | 1914 | inc edx |
|
1990 | inc edx |
1915 | mov [edi+4], dl |
- | 1916 | mov [edi+5], al |
|
1991 | mov [edi+4], dl |
1917 | mov [edi+6], bx |
Line -... | Line 1918... | ||
- | 1918 | add edi, 8 |
|
- | 1919 | pop ecx ebx |
|
- | 1920 | ret |
|
- | 1921 | ||
- | 1922 | .sec: |
|
1992 | mov [edi+5], al |
1923 | push ebx ecx |
1993 | add edi, 8 |
1924 | mov ebx, edx |
1994 | ret |
1925 | jmp .forEXT |
1995 | 1926 | ||
Line 1996... | Line 1927... | ||
1996 | ;---------------------------------------------------------------- |
1927 | ;---------------------------------------------------------------- |
1997 | ntfs_CreateFolder: |
1928 | ntfs_CreateFolder: |
1998 | mov [ebp+NTFS.ntfsFolder], 1 |
1929 | mov [ebp+NTFS.bFolder], 1 |
1999 | jmp @f |
1930 | jmp @f |
2000 | 1931 | ||
2001 | ntfs_CreateFile: |
1932 | ntfs_CreateFile: |
2002 | mov [ebp+NTFS.ntfsFolder], 0 |
1933 | mov [ebp+NTFS.bFolder], 0 |
2003 | @@: |
1934 | @@: |
- | 1935 | cmp byte [esi], 0 |
|
2004 | cmp byte [esi], 0 |
1936 | jnz @f |
2005 | jnz @f |
1937 | xor ebx, ebx |
2006 | xor ebx, ebx |
1938 | movi eax, ERROR_ACCESS_DENIED |
2007 | movi eax, ERROR_ACCESS_DENIED |
1939 | ret |
2008 | ret |
1940 | |
2009 | @@: ; 1. Search file |
1941 | @@: ; 1. Search file |
2010 | call ntfs_lock |
1942 | call ntfs_lock |
2011 | stdcall ntfs_find_lfn, [esp+4] |
1943 | stdcall ntfs_find_lfn, [esp+4] |
2012 | jc .notFound |
1944 | jc .notFound |
2013 | ; found, rewrite |
1945 | ; found, rewrite |
2014 | cmp [ebp+NTFS.ntfs_cur_iRecord], 16 |
1946 | cmp [ebp+NTFS.cur_iRecord], 16 |
2015 | jc ntfsDenied |
1947 | jc ntfsDenied |
2016 | cmp [ebp+NTFS.ntfsFolder], 1 |
1948 | cmp [ebp+NTFS.bFolder], 1 |
2017 | jz .folder |
1949 | jz .folder |
2018 | cmp [ebp+NTFS.ntfsFragmentCount], 1 |
1950 | cmp [ebp+NTFS.fragmentCount], 1 |
2019 | jnz ntfsUnsupported ; record fragmented |
1951 | jnz ntfsUnsupported ; record fragmented |
2020 | ; edit directory node |
1952 | ; edit directory node |
2021 | mov edi, [ebp+NTFS.cur_index_buf] |
1953 | mov edi, [ebp+NTFS.cur_index_buf] |
2022 | cmp dword [edi], 'INDX' |
1954 | cmp dword [edi], 'INDX' |
2023 | jz @f |
1955 | jz @f |
2024 | mov esi, [ebp+NTFS.frs_buffer] |
1956 | mov esi, [ebp+NTFS.frs_buffer] |
2025 | mov ecx, [esi+recordRealSize] |
1957 | mov ecx, [esi+recordRealSize] |
2026 | shr ecx, 2 |
1958 | shr ecx, 2 |
2027 | rep movsd |
1959 | rep movsd |
2028 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
1960 | mov esi, [ebp+NTFS.attr_offs] |
2029 | mov cl, [esi+attributeOffset] |
1961 | mov cl, [esi+attributeOffset] |
2030 | sub esi, [ebp+NTFS.frs_buffer] |
1962 | sub esi, [ebp+NTFS.frs_buffer] |
2031 | add eax, ecx |
1963 | add eax, ecx |
2032 | add eax, esi |
1964 | add eax, esi |
2033 | @@: |
1965 | @@: |
2034 | mov edx, [ebx+12] |
1966 | mov edx, [ebx+12] |
2035 | mov [eax+fileRealSize], edx |
1967 | mov [eax+fileRealSize], edx |
2036 | mov dword [eax+fileRealSize+4], 0 |
1968 | mov dword [eax+fileRealSize+4], 0 |
2037 | mov eax, [ebp+NTFS.ntfsLastRead] |
1969 | mov eax, [ebp+NTFS.LastRead] |
2038 | mov [ebp+NTFS.nodeLastRead], eax |
1970 | mov [ebp+NTFS.nodeLastRead], eax |
2039 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 |
1971 | mov [ebp+NTFS.cur_attr], 0x80 |
2040 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
1972 | mov [ebp+NTFS.cur_offs], 0 |
2041 | mov [ebp+NTFS.ntfs_cur_size], 0 |
1973 | mov [ebp+NTFS.cur_size], 0 |
2042 | call ntfs_read_attr |
1974 | call ntfs_read_attr |
2043 | jc ntfsFail |
1975 | jc ntfsFail |
2044 | mov ecx, [ebp+NTFS.frs_buffer] |
1976 | mov ecx, [ebp+NTFS.frs_buffer] |
2045 | mov eax, edx |
1977 | mov eax, edx |
2046 | xor edx, edx |
1978 | xor edx, edx |
2047 | cmp word [ecx+baseRecordReuse], 0 |
1979 | cmp word [ecx+baseRecordReuse], 0 |
2048 | jnz ntfsUnsupported ; auxiliary record |
1980 | jnz ntfsUnsupported ; auxiliary record |
2049 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
1981 | mov ecx, [ebp+NTFS.attr_offs] |
Line 2066... | Line 1998... | ||
2066 | jmp ntfsOut |
1998 | jmp ntfsOut |
Line 2067... | Line 1999... | ||
2067 | 1999 | ||
2068 | .notFound: ; create |
2000 | .notFound: ; create |
2069 | test eax, eax |
2001 | test eax, eax |
2070 | jz ntfsFail |
2002 | jz ntfsFail |
2071 | cmp [ebp+NTFS.ntfsFragmentCount], 1 |
2003 | cmp [ebp+NTFS.fragmentCount], 1 |
2072 | jnz ntfsUnsupported ; record fragmented |
2004 | jnz ntfsUnsupported ; record fragmented |
2073 | ; 2. Prepare directory record |
2005 | ; 2. Prepare directory record |
2074 | mov ecx, esi |
2006 | mov ecx, esi |
2075 | @@: ; count characters |
2007 | @@: ; count characters |
2076 | inc ecx |
2008 | inc ecx |
2077 | cmp byte [ecx], '/' |
2009 | cmp byte [ecx], '/' |
2078 | jz ntfsNotFound ; path folder not found |
2010 | jz ntfsNotFound ; path folder not found |
2079 | cmp byte [ecx], 0 |
2011 | cmp byte [ecx], 0 |
2080 | jnz @b |
2012 | jnz @b |
- | 2013 | sub ecx, esi |
|
2081 | sub ecx, esi |
2014 | push ecx ; name length |
2082 | push ecx |
2015 | shl ecx, 1 |
2083 | lea ecx, [ecx*2+52h+7] ; precalculate index length |
2016 | add ecx, fileName+7 |
2084 | and ecx, not 7 ; align 8 |
2017 | and ecx, not 7 |
- | 2018 | mov edi, [ebp+NTFS.cur_index_buf] |
|
- | 2019 | mov edx, [ebx+12] |
|
- | 2020 | mov [ebp+NTFS.fileRealSize], edx |
|
- | 2021 | mov edx, [ebx+16] |
|
2085 | mov edi, [ebp+NTFS.cur_index_buf] |
2022 | mov [ebp+NTFS.fileDataBuffer], edx |
- | 2023 | push esi |
|
2086 | push esi |
2024 | push ecx ; index length |
2087 | push ecx |
2025 | mov edx, ecx |
2088 | cmp dword [edi], 'INDX' |
2026 | cmp dword [edi], 'INDX' |
2089 | jz .indexRecord |
2027 | jz .indexRecord |
2090 | mov esi, [ebp+NTFS.frs_buffer] ; indexRoot |
2028 | mov esi, [ebp+NTFS.frs_buffer] ; indexRoot |
2091 | mov edx, [esi+recordRealSize] |
2029 | mov ecx, [esi+recordRealSize] |
2092 | add edx, ecx |
2030 | add edx, ecx |
2093 | cmp [esi+recordAllocatedSize], edx |
- | |
2094 | jnc @f |
2031 | cmp [esi+recordAllocatedSize], edx |
2095 | add esp, 12 |
- | |
2096 | jmp ntfsUnsupported ; indexAllocation required |
- | |
2097 | @@: ; index fits in the indexRoot |
2032 | jc .growTree |
2098 | mov [esi+recordRealSize], edx |
- | |
2099 | mov ecx, edx |
2033 | mov [esi+recordRealSize], edx |
2100 | shr ecx, 2 |
2034 | shr ecx, 2 |
2101 | rep movsd |
2035 | rep movsd |
2102 | mov edi, [ebp+NTFS.ntfs_attr_offs] |
2036 | mov edi, [ebp+NTFS.attr_offs] |
2103 | sub edi, [ebp+NTFS.frs_buffer] |
2037 | sub edi, [ebp+NTFS.frs_buffer] |
2104 | add edi, [ebp+NTFS.cur_index_buf] |
2038 | add edi, [ebp+NTFS.cur_index_buf] |
2105 | mov esi, [esp] |
2039 | mov esi, [esp] |
2106 | add [edi+sizeWithHeader], esi |
2040 | add [edi+sizeWithHeader], esi |
2107 | add [edi+sizeWithoutHeader], esi |
2041 | add [edi+sizeWithoutHeader], esi |
2108 | mov cl, [edi+attributeOffset] |
2042 | mov cl, [edi+attributeOffset] |
2109 | add edi, ecx |
2043 | add edi, ecx |
2110 | add [edi+16+nodeRealSize], esi |
2044 | add [edi+rootNode+nodeRealSize], esi |
2111 | add [edi+16+nodeAllocatedSize], esi |
2045 | add [edi+rootNode+nodeAllocatedSize], esi |
2112 | sub eax, [ebp+NTFS.cur_index_buf] |
2046 | sub eax, [ebp+NTFS.cur_index_buf] |
2113 | add eax, edi |
2047 | add eax, edi |
2114 | mov edi, [ebp+NTFS.cur_index_buf] |
- | |
2115 | add edi, edx |
- | |
2116 | sub edi, 4 |
2048 | mov edi, [ebp+NTFS.cur_index_buf] |
Line -... | Line 2049... | ||
- | 2049 | jmp .common |
|
- | 2050 | ||
- | 2051 | @@: |
|
- | 2052 | add esp, 16 |
|
- | 2053 | jmp ntfsUnsupported |
|
- | 2054 | ||
- | 2055 | .growTree: |
|
- | 2056 | sub eax, rootNode |
|
- | 2057 | sub eax, [edi+rootNode+indexOffset] |
|
- | 2058 | push eax |
|
- | 2059 | ; create indexRecord |
|
- | 2060 | mov ecx, 10 |
|
- | 2061 | xor eax, eax |
|
- | 2062 | rep stosd |
|
- | 2063 | rdtsc |
|
- | 2064 | stosw |
|
- | 2065 | mov esi, [ebp+NTFS.attr_offs] |
|
- | 2066 | mov cl, [esi+attributeOffset] |
|
- | 2067 | add esi, ecx |
|
- | 2068 | mov eax, [esi+indexRecordSizeClus] |
|
- | 2069 | cmp eax, 129 |
|
- | 2070 | jnc @b |
|
- | 2071 | mov [ebp+NTFS.fileDataSize], eax |
|
- | 2072 | mov eax, [esi+indexRecordSize] |
|
- | 2073 | cmp eax, [ebp+NTFS.frs_size] |
|
- | 2074 | jc @b |
|
- | 2075 | shr eax, 9 |
|
- | 2076 | inc eax |
|
- | 2077 | mov edi, [ebp+NTFS.cur_index_buf] |
|
- | 2078 | mov dword[edi], 'INDX' |
|
- | 2079 | mov byte [edi+updateSequenceOffset], 28h |
|
- | 2080 | mov [edi+updateSequenceSize], al |
|
- | 2081 | add edi, recordNode |
|
- | 2082 | shl eax, 1 |
|
- | 2083 | add eax, 28h-recordNode+7 |
|
- | 2084 | and eax, not 7 |
|
- | 2085 | mov [edi+indexOffset], eax |
|
- | 2086 | mov ecx, [esi+indexRecordSize] |
|
- | 2087 | sub ecx, recordNode |
|
- | 2088 | mov [edi+nodeAllocatedSize], ecx |
|
- | 2089 | add esi, rootNode |
|
- | 2090 | push esi |
|
- | 2091 | mov ecx, [esi+nodeRealSize] |
|
- | 2092 | sub ecx, [esi+indexOffset] |
|
- | 2093 | add eax, ecx |
|
- | 2094 | mov [edi+nodeRealSize], eax |
|
- | 2095 | shr ecx, 2 |
|
- | 2096 | add esi, [esi+indexOffset] |
|
- | 2097 | add edi, [edi+indexOffset] |
|
- | 2098 | rep movsd ; copy root indexes |
|
- | 2099 | ; clear root node |
|
- | 2100 | mov cl, 10 |
|
- | 2101 | mov edi, [esp] |
|
- | 2102 | xor eax, eax |
|
- | 2103 | rep stosd |
|
- | 2104 | pop edi |
|
- | 2105 | mov byte [edi+indexOffset], 16 |
|
- | 2106 | mov byte [edi+nodeRealSize], 28h |
|
- | 2107 | mov byte [edi+nodeAllocatedSize], 28h |
|
- | 2108 | mov byte [edi+nonLeafFlag], 1 |
|
- | 2109 | mov byte [edi+16+indexAllocatedSize], 18h |
|
- | 2110 | mov byte [edi+16+indexFlags], 3 |
|
- | 2111 | mov esi, [ebp+NTFS.attr_offs] |
|
- | 2112 | add edi, 28h |
|
- | 2113 | mov eax, edi |
|
- | 2114 | sub eax, esi |
|
- | 2115 | mov word [esi+sizeWithoutHeader], 38h |
|
- | 2116 | xchg [esi+sizeWithHeader], eax |
|
- | 2117 | cmp byte [esi+eax], -1 |
|
- | 2118 | jnz @b |
|
- | 2119 | mov cl, 32 |
|
- | 2120 | xor eax, eax |
|
- | 2121 | push edi |
|
- | 2122 | rep stosd |
|
- | 2123 | mov edi, [ebp+NTFS.BitmapStart] |
|
- | 2124 | call ntfsSpaceAlloc |
|
- | 2125 | jnc @f |
|
- | 2126 | add esp, 20 |
|
- | 2127 | jmp ntfsDiskFull |
|
- | 2128 | ||
- | 2129 | @@: ; create $IndexAllocation |
|
- | 2130 | pop edi |
|
- | 2131 | mov byte [edi+attributeType], 0xA0 |
|
- | 2132 | mov byte [edi+nonResidentFlag], 1 |
|
- | 2133 | mov byte [edi+nameLength], 4 |
|
- | 2134 | mov byte [edi+nameOffset], 40h |
|
- | 2135 | mov byte [edi+dataRunsOffset], 48h |
|
- | 2136 | mov byte [edi+sizeWithHeader], 50h |
|
- | 2137 | mov eax, [ebp+NTFS.fileDataSize] |
|
- | 2138 | dec eax |
|
- | 2139 | mov [edi+lastVCN], eax |
|
- | 2140 | inc eax |
|
- | 2141 | mul [ebp+NTFS.sectors_per_cluster] |
|
- | 2142 | shl eax, 9 |
|
- | 2143 | mov [edi+attributeAllocatedSize], eax |
|
- | 2144 | mov [edi+attributeRealSize], eax |
|
- | 2145 | mov [edi+initialDataSize], eax |
|
- | 2146 | mov dword[edi+40h], 490024h ; unicode $I30 |
|
- | 2147 | mov dword[edi+40h+4], 300033h |
|
- | 2148 | push edi |
|
- | 2149 | mov esi, edi |
|
- | 2150 | add edi, 48h |
|
- | 2151 | call createMcbEntry |
|
- | 2152 | mov esi, [ebp+NTFS.frs_buffer] |
|
- | 2153 | pop edi |
|
- | 2154 | mov al, [esi+newAttributeID] |
|
- | 2155 | mov [edi+attributeID], al |
|
- | 2156 | add edi, 50h |
|
- | 2157 | inc eax |
|
- | 2158 | ; create $Bitmap |
|
- | 2159 | mov [edi+attributeID], al |
|
- | 2160 | inc eax |
|
- | 2161 | mov [esi+newAttributeID], al |
|
- | 2162 | mov byte [edi+attributeType], 0xB0 |
|
- | 2163 | mov byte [edi+nameLength], 4 |
|
- | 2164 | mov byte [edi+nameOffset], 18h |
|
- | 2165 | mov byte [edi+attributeOffset], 20h |
|
- | 2166 | mov byte [edi+sizeWithoutHeader], 8 |
|
- | 2167 | mov byte [edi+sizeWithHeader], 28h |
|
- | 2168 | mov dword[edi+18h], 490024h ; unicode $I30 |
|
- | 2169 | mov dword[edi+18h+4], 300033h |
|
- | 2170 | mov byte [edi+20h], 1 |
|
- | 2171 | mov dword[edi+28h], -1 |
|
- | 2172 | add edi, 30h |
|
- | 2173 | sub edi, esi |
|
- | 2174 | mov [esi+recordRealSize], edi |
|
- | 2175 | mov [ebp+NTFS.cur_buf], esi |
|
- | 2176 | call writeRecord ; fileRecord |
|
- | 2177 | mov eax, [ebp+NTFS.fileDataStart] |
|
- | 2178 | mul [ebp+NTFS.sectors_per_cluster] |
|
- | 2179 | mov [ebp+NTFS.LastRead], eax |
|
- | 2180 | mov eax, [ebp+NTFS.cur_index_buf] |
|
- | 2181 | mov [ebp+NTFS.cur_buf], eax |
|
- | 2182 | call writeRecord ; indexRecord |
|
- | 2183 | mov ebx, [ebp+NTFS.cur_index_buf] |
|
- | 2184 | mov ax, [ebx+6] |
|
- | 2185 | dec eax |
|
- | 2186 | shl eax, 9 |
|
- | 2187 | call ntfs_restore_usa |
|
- | 2188 | mov edi, [ebp+NTFS.cur_index_buf] |
|
- | 2189 | pop eax |
|
- | 2190 | add eax, recordNode |
|
2117 | jmp .common |
2191 | add eax, [edi+recordNode+indexOffset] |
2118 | 2192 | mov edx, [esp] |
|
2119 | .indexRecord: |
2193 | .indexRecord: |
2120 | mov edx, [edi+28] |
2194 | add edi, recordNode |
2121 | add edx, ecx |
2195 | add edx, [edi+nodeRealSize] |
2122 | cmp [edi+32], edx |
2196 | cmp [edi+nodeAllocatedSize], edx |
2123 | jnc @f |
2197 | jnc @f |
- | 2198 | add esp, 12 |
|
2124 | add esp, 12 |
2199 | jmp ntfsUnsupported ; new node required |
2125 | jmp ntfsUnsupported ; new node required |
2200 | |
2126 | @@: ; index fits in the node |
- | |
2127 | mov [edi+28], edx |
2201 | @@: ; index fits in the node |
- | 2202 | mov [edi+nodeRealSize], edx |
|
- | 2203 | .common: |
|
2128 | lea edi, [edi+edx+24-4] |
2204 | add edi, edx |
2129 | .common: |
2205 | sub edi, 4 |
2130 | mov esi, edi |
2206 | mov esi, edi |
2131 | sub esi, [esp] |
2207 | sub esi, [esp] |
2132 | mov ecx, esi |
2208 | mov ecx, esi |
2133 | sub ecx, eax ; eax = pointer in the node |
2209 | sub ecx, eax ; eax = pointer in the record |
2134 | shr ecx, 2 |
2210 | shr ecx, 2 |
2135 | inc ecx |
2211 | inc ecx |
2136 | std |
2212 | std |
Line 2146... | Line 2222... | ||
2146 | mov [edi+indexAllocatedSize], cx ; fill index with data |
2222 | mov [edi+indexAllocatedSize], cx ; fill index with data |
2147 | mov eax, [esp] |
2223 | mov eax, [esp] |
2148 | shl eax, 1 |
2224 | shl eax, 1 |
2149 | add eax, 42h |
2225 | add eax, 42h |
2150 | mov [edi+indexRawSize], ax |
2226 | mov [edi+indexRawSize], ax |
2151 | mov eax, [ebp+NTFS.ntfs_attr_iRecord] |
2227 | mov eax, [ebp+NTFS.attr_iRecord] |
2152 | mov [edi+directoryRecordReference], eax |
2228 | mov [edi+directoryRecordReference], eax |
2153 | mov eax, [ebp+NTFS.frs_buffer] |
2229 | mov eax, [ebp+NTFS.frs_buffer] |
2154 | mov eax, [eax+reuseCounter] |
2230 | mov eax, [eax+reuseCounter] |
2155 | mov [edi+directoryReferenceReuse], ax |
2231 | mov [edi+directoryReferenceReuse], ax |
2156 | mov eax, [ebx+12] |
2232 | mov eax, [ebp+NTFS.frs_size] |
- | 2233 | shr eax, 8 |
|
2157 | add ecx, 30h+48h+8+18h+8 |
2234 | add ecx, 30h+48h+8+18h+8 |
2158 | add ecx, eax |
2235 | add ecx, eax |
2159 | mov [ebp+NTFS.fileRealSize], eax |
2236 | mov eax, [ebp+NTFS.fileRealSize] |
- | 2237 | add ecx, eax |
|
2160 | mov [edi+fileRealSize], eax |
2238 | mov [edi+fileRealSize], eax |
2161 | cmp [ebp+NTFS.frs_size], ecx |
2239 | cmp [ebp+NTFS.frs_size], ecx |
2162 | jc @f |
2240 | jc @f |
2163 | mov eax, [ebx+16] |
- | |
2164 | mov [ebp+NTFS.fileDataStart], eax |
- | |
2165 | xor eax, eax |
2241 | xor eax, eax |
2166 | @@: |
2242 | @@: |
2167 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
2243 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
2168 | shl ecx, 9 |
2244 | shl ecx, 9 |
2169 | add eax, ecx |
2245 | add eax, ecx |
Line 2174... | Line 2250... | ||
2174 | mul ecx |
2250 | mul ecx |
2175 | mov [edi+fileAllocatedSize], eax |
2251 | mov [edi+fileAllocatedSize], eax |
2176 | pop ecx |
2252 | pop ecx |
2177 | mov [ebp+NTFS.indexOffset], edi |
2253 | mov [ebp+NTFS.indexOffset], edi |
2178 | mov [edi+fileNameLength], cl |
2254 | mov [edi+fileNameLength], cl |
2179 | add edi, 52h |
2255 | add edi, fileName |
2180 | @@: ; record filename |
2256 | @@: ; record filename |
2181 | lodsb |
2257 | lodsb |
2182 | call ansi2uni_char |
2258 | call ansi2uni_char |
2183 | stosw |
2259 | stosw |
2184 | dec ecx |
2260 | dec ecx |
2185 | jnz @b |
2261 | jnz @b |
2186 | mov eax, [ebp+NTFS.ntfsLastRead] |
2262 | mov eax, [ebp+NTFS.LastRead] |
2187 | mov [ebp+NTFS.nodeLastRead], eax |
2263 | mov [ebp+NTFS.nodeLastRead], eax |
2188 | cmp [ebp+NTFS.ntfsFolder], 0 |
2264 | cmp [ebp+NTFS.bFolder], 0 |
2189 | jz @f |
2265 | jz @f |
2190 | mov edi, [ebp+NTFS.indexOffset] |
2266 | mov edi, [ebp+NTFS.indexOffset] |
2191 | bts dword [edi+fileFlags], 28 |
2267 | bts dword [edi+fileFlags], 28 |
2192 | jmp .mftBitmap |
2268 | jmp .mftBitmap |
Line 2195... | Line 2271... | ||
2195 | cmp [ebp+NTFS.fileDataSize], 0 |
2271 | cmp [ebp+NTFS.fileDataSize], 0 |
2196 | jz .mftBitmap |
2272 | jz .mftBitmap |
2197 | mov edi, [ebp+NTFS.BitmapStart] |
2273 | mov edi, [ebp+NTFS.BitmapStart] |
2198 | call ntfsSpaceAlloc |
2274 | call ntfsSpaceAlloc |
2199 | jc ntfsDiskFull |
2275 | jc ntfsDiskFull |
2200 | mov [ebp+NTFS.fileDataStart], eax |
2276 | mov eax, [ebp+NTFS.fileDataStart] |
2201 | mul [ebp+NTFS.sectors_per_cluster] |
2277 | mul [ebp+NTFS.sectors_per_cluster] |
2202 | mov ecx, [ebp+NTFS.fileRealSize] |
2278 | mov ecx, [ebp+NTFS.fileRealSize] |
2203 | add ecx, 511 |
2279 | add ecx, 511 |
2204 | shr ecx, 9 |
2280 | shr ecx, 9 |
2205 | mov ebx, [ebx+16] |
2281 | mov ebx, [ebp+NTFS.fileDataBuffer] |
2206 | call fs_write64_app |
2282 | call fs_write64_app |
2207 | test eax, eax |
2283 | test eax, eax |
2208 | jnz ntfsDevice |
2284 | jnz ntfsDevice |
2209 | ; 4. MFT record |
2285 | ; 4. MFT record |
2210 | .mftBitmap: ; search for free record |
2286 | .mftBitmap: ; search for free record |
Line 2226... | Line 2302... | ||
2226 | add edi, ecx |
2302 | add edi, ecx |
2227 | mov [ebp+NTFS.newMftRecord], edi |
2303 | mov [ebp+NTFS.newMftRecord], edi |
2228 | mov eax, [ebp+NTFS.frs_size] |
2304 | mov eax, [ebp+NTFS.frs_size] |
2229 | shr eax, 9 |
2305 | shr eax, 9 |
2230 | mul edi |
2306 | mul edi |
2231 | mov [ebp+NTFS.ntfs_cur_iRecord], 0 |
2307 | mov [ebp+NTFS.cur_iRecord], 0 |
2232 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 |
2308 | mov [ebp+NTFS.cur_attr], 0x80 |
2233 | mov [ebp+NTFS.ntfs_cur_offs], eax |
2309 | mov [ebp+NTFS.cur_offs], eax |
2234 | mov [ebp+NTFS.ntfs_cur_size], 1 |
2310 | mov [ebp+NTFS.cur_size], 1 |
2235 | mov eax, [ebp+NTFS.frs_buffer] |
2311 | mov eax, [ebp+NTFS.frs_buffer] |
2236 | mov [ebp+NTFS.ntfs_cur_buf], eax |
2312 | mov [ebp+NTFS.cur_buf], eax |
2237 | call ntfs_read_attr |
2313 | call ntfs_read_attr |
2238 | cmp [ebp+NTFS.ntfs_cur_read], 0 |
2314 | cmp [ebp+NTFS.cur_read], 0 |
2239 | jz .extendMFT |
2315 | jz .extendMFT |
2240 | jmp .mftRecord |
2316 | jmp .mftRecord |
Line 2241... | Line 2317... | ||
2241 | 2317 | ||
2242 | .extendBitmapMFT: |
2318 | .extendBitmapMFT: |
2243 | mov eax, [ebp+NTFS.sectors_per_cluster] |
2319 | mov eax, [ebp+NTFS.sectors_per_cluster] |
2244 | shl eax, 9 |
2320 | shl eax, 9 |
2245 | cmp [ebp+NTFS.mftBitmapSize], eax |
2321 | cmp [ebp+NTFS.mftBitmapSize], eax |
2246 | jnc ntfsUnsupported |
2322 | jnc ntfsUnsupported |
2247 | mov [ebp+NTFS.ntfs_cur_iRecord], 0 |
2323 | mov [ebp+NTFS.cur_iRecord], 0 |
2248 | mov [ebp+NTFS.ntfs_cur_attr], 0xB0 |
2324 | mov [ebp+NTFS.cur_attr], 0xB0 |
2249 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
2325 | mov [ebp+NTFS.cur_offs], 0 |
2250 | mov [ebp+NTFS.ntfs_cur_size], 0 |
2326 | mov [ebp+NTFS.cur_size], 0 |
2251 | call ntfs_read_attr |
2327 | call ntfs_read_attr |
2252 | jc ntfsFail |
2328 | jc ntfsFail |
2253 | mov eax, [ebp+NTFS.mft_cluster] |
2329 | mov eax, [ebp+NTFS.mft_cluster] |
2254 | mul [ebp+NTFS.sectors_per_cluster] |
2330 | mul [ebp+NTFS.sectors_per_cluster] |
2255 | cmp eax, [ebp+NTFS.ntfsLastRead] |
2331 | cmp eax, [ebp+NTFS.LastRead] |
2256 | jnz ntfsUnsupported ; auxiliary record |
2332 | jnz ntfsUnsupported ; auxiliary record |
2257 | mov edi, [ebp+NTFS.mftBitmapBuffer] |
2333 | mov edi, [ebp+NTFS.mftBitmapBuffer] |
2258 | mov ecx, [ebp+NTFS.mftBitmapSize] |
2334 | mov ecx, [ebp+NTFS.mftBitmapSize] |
2259 | add edi, ecx |
2335 | add edi, ecx |
2260 | mov eax, ecx |
2336 | mov eax, ecx |
2261 | mov edx, [ebp+NTFS.ntfs_attr_offs] |
2337 | mov edx, [ebp+NTFS.attr_offs] |
2262 | add ecx, 8 |
2338 | add ecx, 8 |
2263 | mov [edx+attributeRealSize], ecx |
2339 | mov [edx+attributeRealSize], ecx |
2264 | mov [edx+initialDataSize], ecx |
2340 | mov [edx+initialDataSize], ecx |
2265 | shl eax, 3 |
2341 | shl eax, 3 |
2266 | mov [ebp+NTFS.newMftRecord], eax |
2342 | mov [ebp+NTFS.newMftRecord], eax |
2267 | mov dword [edi], 1 |
2343 | mov dword [edi], 1 |
2268 | mov dword [edi+4], 0 |
2344 | mov dword [edi+4], 0 |
2269 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 |
2345 | mov [ebp+NTFS.cur_attr], 0x80 |
2270 | call ntfs_read_attr.newAttribute |
2346 | call ntfs_read_attr.newAttribute |
2271 | jc ntfsFail |
2347 | jc ntfsFail |
2272 | mov [ebp+NTFS.mftBitmapSize], ecx |
2348 | mov [ebp+NTFS.mftBitmapSize], ecx |
2273 | .extendMFT: |
2349 | .extendMFT: |
2274 | mov eax, [ebp+NTFS.mft_cluster] |
2350 | mov eax, [ebp+NTFS.mft_cluster] |
2275 | mul [ebp+NTFS.sectors_per_cluster] |
2351 | mul [ebp+NTFS.sectors_per_cluster] |
2276 | cmp eax, [ebp+NTFS.ntfsLastRead] |
2352 | cmp eax, [ebp+NTFS.LastRead] |
2277 | jnz ntfsUnsupported ; auxiliary record |
2353 | jnz ntfsUnsupported ; auxiliary record |
2278 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
2354 | mov ecx, [ebp+NTFS.attr_offs] |
2279 | mov eax, [ecx+attributeRealSize] |
2355 | mov eax, [ecx+attributeRealSize] |
2280 | mov edx, [ecx+attributeRealSize+4] |
2356 | mov edx, [ecx+attributeRealSize+4] |
2281 | xor ax, ax |
2357 | xor ax, ax |
2282 | add eax, 10000h |
2358 | add eax, 10000h |
2283 | adc edx, 0 |
2359 | adc edx, 0 |
2284 | push [ebp+NTFS.fileDataStart] |
2360 | push [ebp+NTFS.fileDataStart] |
2285 | push [ebp+NTFS.fileDataSize] |
2361 | push [ebp+NTFS.fileDataSize] |
2286 | call resizeAttribute |
2362 | call resizeAttribute |
2287 | jc ntfsErrorPop2 |
2363 | jc ntfsErrorPop2 |
2288 | mov eax, [ebp+NTFS.frs_buffer] |
2364 | mov eax, [ebp+NTFS.frs_buffer] |
2289 | mov [ebp+NTFS.ntfs_cur_buf], eax |
2365 | mov [ebp+NTFS.cur_buf], eax |
2290 | call writeRecord ; $MFT |
2366 | call writeRecord ; $MFT |
2291 | mov eax, [ebp+NTFS.mftmirr_cluster] |
2367 | mov eax, [ebp+NTFS.mftmirr_cluster] |
2292 | mul [ebp+NTFS.sectors_per_cluster] |
2368 | mul [ebp+NTFS.sectors_per_cluster] |
2293 | mov ebx, [ebp+NTFS.frs_buffer] |
2369 | mov ebx, [ebp+NTFS.frs_buffer] |
Line 2303... | Line 2379... | ||
2303 | mov edi, [ebp+NTFS.frs_buffer] |
2379 | mov edi, [ebp+NTFS.frs_buffer] |
2304 | xor eax, eax |
2380 | xor eax, eax |
2305 | rep stosd |
2381 | rep stosd |
2306 | mov edi, [ebp+NTFS.frs_buffer] |
2382 | mov edi, [ebp+NTFS.frs_buffer] |
2307 | ; record header |
2383 | ; record header |
- | 2384 | rdtsc |
|
- | 2385 | mov [edi+2ah], ax |
|
2308 | mov eax, [ebp+NTFS.frs_size] |
2386 | mov eax, [ebp+NTFS.frs_size] |
2309 | mov [edi+recordAllocatedSize], eax |
2387 | mov [edi+recordAllocatedSize], eax |
2310 | shr eax, 9 |
2388 | shr eax, 9 |
2311 | inc eax |
2389 | inc eax |
2312 | mov [edi+updateSequenceSize], al |
2390 | mov [edi+updateSequenceSize], al |
- | 2391 | shl eax, 1 |
|
- | 2392 | add eax, 2ah+7 |
|
- | 2393 | and eax, not 7 |
|
2313 | mov dword[edi], 'FILE' |
2394 | mov dword[edi], 'FILE' |
2314 | mov byte [edi+updateSequenceOffset], 2ah |
2395 | mov byte [edi+updateSequenceOffset], 2ah |
2315 | mov byte [edi+hardLinkCounter], 1 |
2396 | mov byte [edi+hardLinkCounter], 1 |
2316 | mov byte [edi+attributeOffset], 30h |
- | |
2317 | mov byte [edi+newAttributeID], 3 |
2397 | mov byte [edi+newAttributeID], 3 |
2318 | rdtsc |
- | |
2319 | mov [edi+2ah], ax |
2398 | mov [edi+attributeOffset], al |
2320 | add edi, 30h |
2399 | add edi, eax |
2321 | ; $StandardInformation |
2400 | ; $StandardInformation |
2322 | mov byte [edi+attributeType], 10h |
2401 | mov byte [edi+attributeType], 10h |
2323 | mov byte [edi+sizeWithHeader], 48h |
2402 | mov byte [edi+sizeWithHeader], 48h |
2324 | mov byte [edi+sizeWithoutHeader], 30h |
2403 | mov byte [edi+sizeWithoutHeader], 30h |
2325 | mov byte [edi+attributeOffset], 18h |
2404 | mov byte [edi+attributeOffset], 18h |
Line 2340... | Line 2419... | ||
2340 | sub ecx, 18h |
2419 | sub ecx, 18h |
2341 | shr ecx, 2 |
2420 | shr ecx, 2 |
2342 | rep movsd |
2421 | rep movsd |
2343 | mov byte [edi+sizeWithHeader], 50h |
2422 | mov byte [edi+sizeWithHeader], 50h |
2344 | mov byte [edi+attributeID], 2 |
2423 | mov byte [edi+attributeID], 2 |
2345 | cmp [ebp+NTFS.ntfsFolder], 1 |
2424 | cmp [ebp+NTFS.bFolder], 1 |
2346 | jz .indexRoot |
2425 | jz .indexRoot |
2347 | ; $Data |
2426 | ; $Data |
2348 | mov byte [edi+attributeType], 80h |
2427 | mov byte [edi+attributeType], 80h |
2349 | mov eax, [ebp+NTFS.fileDataSize] |
2428 | mov eax, [ebp+NTFS.fileDataSize] |
2350 | test eax, eax |
2429 | test eax, eax |
Line 2369... | Line 2448... | ||
2369 | .resident: |
2448 | .resident: |
2370 | mov ecx, [ebp+NTFS.fileRealSize] |
2449 | mov ecx, [ebp+NTFS.fileRealSize] |
2371 | mov [edi+sizeWithoutHeader], ecx |
2450 | mov [edi+sizeWithoutHeader], ecx |
2372 | mov byte [edi+attributeOffset], 18h |
2451 | mov byte [edi+attributeOffset], 18h |
2373 | push edi |
2452 | push edi |
2374 | mov esi, [ebp+NTFS.fileDataStart] |
2453 | mov esi, [ebp+NTFS.fileDataBuffer] |
2375 | add edi, 18h |
2454 | add edi, 18h |
2376 | rep movsb |
2455 | rep movsb |
2377 | @@: |
2456 | @@: |
2378 | mov eax, edi |
2457 | mov eax, edi |
2379 | pop edi |
2458 | pop edi |
Line 2381... | Line 2460... | ||
2381 | add eax, 7 |
2460 | add eax, 7 |
2382 | and eax, not 7 |
2461 | and eax, not 7 |
2383 | mov [edi+sizeWithHeader], eax |
2462 | mov [edi+sizeWithHeader], eax |
2384 | add edi, eax |
2463 | add edi, eax |
2385 | mov al, 1 |
2464 | mov al, 1 |
2386 | jmp @f |
2465 | jmp .end |
Line 2387... | Line 2466... | ||
2387 | 2466 | ||
2388 | .indexRoot: |
2467 | .indexRoot: |
2389 | mov byte [edi+attributeType], 90h |
2468 | mov byte [edi+attributeType], 90h |
2390 | mov byte [edi+nameLength], 4 |
2469 | mov byte [edi+nameLength], 4 |
2391 | mov byte [edi+nameOffset], 18h |
2470 | mov byte [edi+nameOffset], 18h |
2392 | mov byte [edi+sizeWithoutHeader], 30h |
2471 | mov byte [edi+sizeWithoutHeader], 30h |
2393 | mov byte [edi+attributeOffset], 20h |
2472 | mov byte [edi+attributeOffset], 20h |
2394 | mov dword[edi+18h], 490024h ; unicode $I30 |
2473 | mov dword[edi+18h], 490024h ; unicode $I30 |
2395 | mov dword[edi+18h+4], 300033h |
2474 | mov dword[edi+18h+4], 300033h |
2396 | mov byte [edi+20h+attributeType], 30h |
2475 | mov byte [edi+20h+indexedAttributesType], 30h |
2397 | mov byte [edi+20h+collationRule], 1 |
2476 | mov byte [edi+20h+collationRule], 1 |
- | 2477 | mov eax, [ebp+NTFS.sectors_per_cluster] |
|
- | 2478 | mov dl, 1 |
|
- | 2479 | shl eax, 8 |
|
2398 | mov eax, [ebp+NTFS.sectors_per_cluster] |
2480 | @@: |
- | 2481 | shl eax, 1 |
|
- | 2482 | shl edx, 1 |
|
- | 2483 | cmp eax, [ebp+NTFS.frs_size] |
|
- | 2484 | jc @b |
|
2399 | shl eax, 9 |
2485 | shr edx, 1 |
2400 | mov [edi+20h+indexRecordSize], eax |
2486 | mov [edi+20h+indexRecordSize], eax |
2401 | mov byte [edi+20h+indexRecordSizeClus], 1 |
2487 | mov [edi+20h+indexRecordSizeClus], dl |
2402 | mov byte [edi+30h+indexOffset], 16 |
2488 | mov byte [edi+30h+indexOffset], 16 |
2403 | mov byte [edi+30h+nodeRealSize], 32 |
2489 | mov byte [edi+30h+nodeRealSize], 32 |
2404 | mov byte [edi+30h+nodeAllocatedSize], 32 |
2490 | mov byte [edi+30h+nodeAllocatedSize], 32 |
2405 | mov byte [edi+40h+indexAllocatedSize], 16 |
2491 | mov byte [edi+40h+indexAllocatedSize], 16 |
2406 | mov byte [edi+40h+indexFlags], 2 |
2492 | mov byte [edi+40h+indexFlags], 2 |
2407 | add edi, 50h |
2493 | add edi, 50h |
2408 | mov al, 3 |
2494 | mov al, 3 |
2409 | @@: |
2495 | .end: |
2410 | mov esi, [ebp+NTFS.frs_buffer] |
2496 | mov esi, [ebp+NTFS.frs_buffer] |
2411 | mov dword [edi], -1 |
2497 | mov dword [edi], -1 |
2412 | mov dword [edi+4], 0 |
2498 | mov dword [edi+4], 0 |
2413 | add edi, 8 |
2499 | add edi, 8 |
2414 | sub edi, esi |
2500 | sub edi, esi |
2415 | mov [ebp+NTFS.ntfs_cur_buf], esi |
2501 | mov [ebp+NTFS.cur_buf], esi |
2416 | mov [esi+recordFlags], al |
2502 | mov [esi+recordFlags], al |
2417 | mov [esi+recordRealSize], edi |
2503 | mov [esi+recordRealSize], edi |
2418 | call writeRecord |
- | |
2419 | test eax, eax |
- | |
2420 | jnz ntfsDevice |
2504 | call writeRecord |
2421 | ; write MFT bitmap |
2505 | ; write MFT bitmap |
2422 | mov eax, [ebp+NTFS.newMftRecord] |
2506 | mov eax, [ebp+NTFS.newMftRecord] |
2423 | shr eax, 3+9 |
2507 | shr eax, 3+9 |
2424 | mov ebx, eax |
2508 | mov ebx, eax |
2425 | shl ebx, 9 |
2509 | shl ebx, 9 |
2426 | add eax, [ebp+NTFS.mftBitmapLocation] |
2510 | add eax, [ebp+NTFS.mftBitmapLocation] |
2427 | add ebx, [ebp+NTFS.mftBitmapBuffer] |
2511 | add ebx, [ebp+NTFS.mftBitmapBuffer] |
2428 | mov ecx, 1 |
2512 | mov ecx, 1 |
2429 | xor edx, edx |
2513 | xor edx, edx |
2430 | call fs_write64_sys |
- | |
2431 | test eax, eax |
- | |
2432 | jnz ntfsDevice |
- | |
2433 | ; 5. Write partition bitmap |
- | |
2434 | cmp [ebp+NTFS.ntfsFolder], 1 |
- | |
2435 | jz @f |
- | |
2436 | mov eax, [ebp+NTFS.fileDataStart] |
- | |
2437 | mov ecx, [ebp+NTFS.fileDataSize] |
- | |
2438 | test ecx, ecx |
- | |
2439 | jz @f |
- | |
2440 | add ecx, eax |
- | |
2441 | add ecx, 4095 |
- | |
2442 | shr ecx, 3+9 |
- | |
2443 | shr eax, 3+9 |
- | |
2444 | sub ecx, eax |
- | |
2445 | mov ebx, eax |
- | |
2446 | shl ebx, 9 |
- | |
2447 | add eax, [ebp+NTFS.BitmapLocation] |
- | |
2448 | add ebx, [ebp+NTFS.BitmapBuffer] |
- | |
2449 | xor edx, edx |
- | |
2450 | call fs_write64_app |
- | |
2451 | test eax, eax |
- | |
2452 | jnz ntfsDevice |
- | |
2453 | @@: |
2514 | call fs_write64_sys |
2454 | mov edi, [ebp+NTFS.indexOffset] |
2515 | mov edi, [ebp+NTFS.indexOffset] |
2455 | mov eax, [ebp+NTFS.newMftRecord] |
2516 | mov eax, [ebp+NTFS.newMftRecord] |
2456 | mov [edi+fileRecordReference], eax |
2517 | mov [edi+fileRecordReference], eax |
2457 | ; 6. Write directory node |
2518 | ; 5. Write directory node |
2458 | mov eax, [ebp+NTFS.nodeLastRead] |
2519 | mov eax, [ebp+NTFS.nodeLastRead] |
2459 | mov [ebp+NTFS.ntfsLastRead], eax |
2520 | mov [ebp+NTFS.LastRead], eax |
2460 | mov eax, [ebp+NTFS.cur_index_buf] |
2521 | mov eax, [ebp+NTFS.cur_index_buf] |
2461 | mov [ebp+NTFS.ntfs_cur_buf], eax |
2522 | mov [ebp+NTFS.cur_buf], eax |
2462 | call writeRecord |
2523 | call writeRecord |
2463 | mov ebx, [ebp+NTFS.fileRealSize] |
2524 | mov ebx, [ebp+NTFS.fileRealSize] |
2464 | ntfsDone: |
2525 | ntfsDone: |
2465 | mov esi, [ebp+PARTITION.Disk] |
2526 | mov esi, [ebp+PARTITION.Disk] |
Line 2469... | Line 2530... | ||
2469 | ret |
2530 | ret |
Line 2470... | Line 2531... | ||
2470 | 2531 | ||
2471 | writeRecord: |
2532 | writeRecord: |
2472 | ; make updateSequence and write to disk |
2533 | ; make updateSequence and write to disk |
2473 | ; in: |
2534 | ; in: |
2474 | ; [ebp+NTFS.ntfs_cur_buf] -> record |
2535 | ; [ebp+NTFS.cur_buf] -> record |
2475 | ; [ebp+NTFS.ntfsLastRead] = partition sector |
2536 | ; [ebp+NTFS.LastRead] = partition sector |
2476 | mov esi, [ebp+NTFS.ntfs_cur_buf] |
2537 | mov esi, [ebp+NTFS.cur_buf] |
2477 | mov edi, esi |
2538 | mov edi, esi |
2478 | movzx ecx, word [esi+updateSequenceOffset] |
2539 | movzx ecx, word [esi+updateSequenceOffset] |
2479 | add edi, ecx |
2540 | add edi, ecx |
2480 | mov ax, [edi] |
2541 | mov ax, [edi] |
Line 2487... | Line 2548... | ||
2487 | add esi, 510 |
2548 | add esi, 510 |
2488 | movsw |
2549 | movsw |
2489 | mov [esi-2], ax |
2550 | mov [esi-2], ax |
2490 | dec ecx |
2551 | dec ecx |
2491 | jnz @b |
2552 | jnz @b |
2492 | mov eax, [ebp+NTFS.ntfsLastRead] |
2553 | mov eax, [ebp+NTFS.LastRead] |
2493 | mov ebx, [ebp+NTFS.ntfs_cur_buf] |
2554 | mov ebx, [ebp+NTFS.cur_buf] |
2494 | pop ecx |
2555 | pop ecx |
2495 | xor edx, edx |
2556 | xor edx, edx |
2496 | jmp fs_write64_sys |
2557 | jmp fs_write64_sys |
Line 2497... | Line 2558... | ||
2497 | 2558 | ||
Line 2557... | Line 2618... | ||
2557 | ret |
2618 | ret |
Line 2558... | Line 2619... | ||
2558 | 2619 | ||
2559 | resizeAttribute: |
2620 | resizeAttribute: |
2560 | ; in: |
2621 | ; in: |
2561 | ; [ebp+NTFS.frs_buffer] -> file record |
2622 | ; [ebp+NTFS.frs_buffer] -> file record |
2562 | ; [ebp+NTFS.ntfs_attr_offs] -> attribute |
2623 | ; [ebp+NTFS.attr_offs] -> attribute |
2563 | ; edx:eax = new size |
2624 | ; edx:eax = new size |
2564 | ; out: |
2625 | ; out: |
2565 | ; [ebp+NTFS.fileDataSize] = clusters added (positive) |
2626 | ; [ebp+NTFS.fileDataSize] = clusters added (positive) |
2566 | ; [ebp+NTFS.fileDataStart] = added block |
2627 | ; [ebp+NTFS.fileDataStart] = added block |
2567 | ; CF=1 -> eax = error code |
2628 | ; CF=1 -> eax = error code |
2568 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
2629 | mov esi, [ebp+NTFS.attr_offs] |
2569 | mov dword [ebp+NTFS.ntfs_attr_size], eax |
2630 | mov dword [ebp+NTFS.attr_size], eax |
2570 | mov dword [ebp+NTFS.ntfs_attr_size+4], edx |
2631 | mov dword [ebp+NTFS.attr_size+4], edx |
2571 | cmp byte [esi+nonResidentFlag], 0 |
2632 | cmp byte [esi+nonResidentFlag], 0 |
2572 | jz .resident |
2633 | jz .resident |
2573 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
2634 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
2574 | shl ecx, 9 |
2635 | shl ecx, 9 |
Line 2607... | Line 2668... | ||
2607 | add edi, [esp] |
2668 | add edi, [esp] |
2608 | push edi |
2669 | push edi |
2609 | shr edi, 5 |
2670 | shr edi, 5 |
2610 | shl edi, 2 |
2671 | shl edi, 2 |
2611 | push eax |
2672 | push eax |
2612 | cmp [ebp+NTFS.ntfs_cur_iRecord], 0 |
2673 | cmp [ebp+NTFS.cur_iRecord], 0 |
2613 | jz @f |
2674 | jz @f |
2614 | cmp edi, [ebp+NTFS.BitmapStart] |
2675 | cmp edi, [ebp+NTFS.BitmapStart] |
2615 | jc .err1 |
2676 | jc .err1 |
2616 | @@: |
2677 | @@: |
2617 | call ntfsSpaceAlloc |
2678 | call ntfsSpaceAlloc |
2618 | jc .err1 |
2679 | jc .err1 |
- | 2680 | mov eax, [ebp+NTFS.fileDataStart] |
|
2619 | pop edi |
2681 | pop edi |
2620 | pop edx |
2682 | pop edx |
2621 | cmp edx, eax |
2683 | cmp edx, eax |
2622 | jnz .newEntry |
2684 | jnz .newEntry |
2623 | pop edx |
2685 | pop edx |
Line 2634... | Line 2696... | ||
2634 | push eax |
2696 | push eax |
2635 | push [ebp+NTFS.fileDataSize] |
2697 | push [ebp+NTFS.fileDataSize] |
2636 | sub eax, edx |
2698 | sub eax, edx |
2637 | mov [ebp+NTFS.fileDataStart], eax |
2699 | mov [ebp+NTFS.fileDataStart], eax |
2638 | @@: |
2700 | @@: |
2639 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
2701 | mov esi, [ebp+NTFS.attr_offs] |
2640 | call createMcbEntry |
2702 | call createMcbEntry |
2641 | pop ecx |
- | |
2642 | pop eax |
- | |
2643 | jc .err2 |
- | |
2644 | mov [ebp+NTFS.fileDataSize], ecx |
2703 | pop [ebp+NTFS.fileDataSize] |
2645 | mov [ebp+NTFS.fileDataStart], eax |
2704 | pop [ebp+NTFS.fileDataStart] |
2646 | .writeBitmap: |
- | |
2647 | add ecx, eax |
- | |
2648 | add ecx, 4095 |
- | |
2649 | shr ecx, 3+9 |
- | |
2650 | shr eax, 3+9 |
- | |
2651 | sub ecx, eax |
- | |
2652 | mov ebx, eax |
- | |
2653 | shl ebx, 9 |
- | |
2654 | add eax, [ebp+NTFS.BitmapLocation] |
- | |
2655 | add ebx, [ebp+NTFS.BitmapBuffer] |
2705 | movi eax, ERROR_UNSUPPORTED_FS |
2656 | xor edx, edx |
- | |
2657 | call fs_write64_app |
- | |
2658 | test eax, eax |
- | |
2659 | jnz @f |
- | |
2660 | .done: |
2706 | .done: |
2661 | ret |
2707 | ret |
Line 2662... | Line -... | ||
2662 | - | ||
2663 | .err4: |
- | |
2664 | pop eax |
- | |
2665 | @@: |
- | |
2666 | movi eax, ERROR_DEVICE |
- | |
2667 | stc |
- | |
2668 | ret |
- | |
2669 | 2708 | ||
2670 | .err1: |
2709 | .err1: |
2671 | add esp, 24 |
2710 | add esp, 24 |
2672 | stc |
2711 | stc |
2673 | .err10: |
2712 | .err2: |
2674 | movi eax, ERROR_DISK_FULL |
2713 | movi eax, ERROR_DISK_FULL |
Line 2675... | Line 2714... | ||
2675 | ret |
2714 | ret |
2676 | 2715 | ||
- | 2716 | .err3: |
|
- | 2717 | movi eax, ERROR_FS_FAIL |
|
2677 | .err2: |
2718 | add esp, 20 |
Line 2678... | Line 2719... | ||
2678 | movi eax, ERROR_UNSUPPORTED_FS |
2719 | stc |
2679 | ret |
2720 | ret |
2680 | 2721 | ||
Line 2714... | Line 2755... | ||
2714 | .end: |
2755 | .end: |
2715 | add esp, 16 |
2756 | add esp, 16 |
2716 | pop edi |
2757 | pop edi |
2717 | cmp [ebp+NTFS.fileDataSize], 0 |
2758 | cmp [ebp+NTFS.fileDataSize], 0 |
2718 | jz @f |
2759 | jz @f |
2719 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
2760 | mov esi, [ebp+NTFS.attr_offs] |
2720 | call createMcbEntry |
2761 | call createMcbEntry |
2721 | mov [ebp+NTFS.fileDataSize], 0 |
2762 | mov [ebp+NTFS.fileDataSize], 0 |
2722 | @@: |
2763 | @@: |
2723 | ret |
2764 | ret |
Line 2724... | Line -... | ||
2724 | - | ||
2725 | .err3: |
- | |
2726 | movi eax, ERROR_FS_FAIL |
- | |
2727 | add esp, 20 |
- | |
2728 | stc |
- | |
2729 | ret |
- | |
2730 | 2765 | ||
2731 | .resident: |
2766 | .resident: |
2732 | test edx, edx |
2767 | test edx, edx |
2733 | jnz .nonResident |
2768 | jnz .nonResident |
2734 | cmp eax, 8000h |
2769 | cmp eax, 8000h |
Line 2758... | Line 2793... | ||
2758 | mov ecx, eax |
2793 | mov ecx, eax |
2759 | shr ecx, 2 |
2794 | shr ecx, 2 |
2760 | xor eax, eax |
2795 | xor eax, eax |
2761 | rep stosd |
2796 | rep stosd |
2762 | cld |
2797 | cld |
2763 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
2798 | mov esi, [ebp+NTFS.attr_offs] |
2764 | @@: |
2799 | @@: |
2765 | mov eax, dword [ebp+NTFS.ntfs_attr_size] |
2800 | mov eax, dword [ebp+NTFS.attr_size] |
2766 | mov [esi+sizeWithoutHeader], eax |
2801 | mov [esi+sizeWithoutHeader], eax |
2767 | mov [ebp+NTFS.fileDataSize], 0 |
2802 | mov [ebp+NTFS.fileDataSize], 0 |
2768 | clc |
2803 | clc |
2769 | ret |
2804 | ret |
Line 2770... | Line 2805... | ||
2770 | 2805 | ||
2771 | .nonResident: ; convert resident to non-resident |
2806 | .nonResident: ; convert resident to non-resident |
2772 | mov eax, dword [ebp+NTFS.ntfs_attr_size] |
2807 | mov eax, dword [ebp+NTFS.attr_size] |
2773 | sub eax, 1 |
2808 | sub eax, 1 |
2774 | sbb edx, 0 |
2809 | sbb edx, 0 |
2775 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
2810 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
2776 | shl ecx, 9 |
2811 | shl ecx, 9 |
Line 2779... | Line 2814... | ||
2779 | mov [ebp+NTFS.fileDataSize], eax |
2814 | mov [ebp+NTFS.fileDataSize], eax |
2780 | mov edi, [ebp+NTFS.BitmapStart] |
2815 | mov edi, [ebp+NTFS.BitmapStart] |
2781 | push ecx |
2816 | push ecx |
2782 | call ntfsSpaceAlloc |
2817 | call ntfsSpaceAlloc |
2783 | pop ecx |
2818 | pop ecx |
2784 | jc .err10 |
2819 | jc .err2 |
2785 | mov [ebp+NTFS.fileDataStart], eax |
- | |
2786 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
2820 | mov esi, [ebp+NTFS.attr_offs] |
2787 | xor eax, eax |
2821 | xor eax, eax |
2788 | xor edx, edx |
2822 | xor edx, edx |
2789 | @@: |
2823 | @@: |
2790 | add eax, ecx |
2824 | add eax, ecx |
2791 | inc edx |
2825 | inc edx |
Line 2808... | Line 2842... | ||
2808 | mov eax, [ebp+NTFS.fileDataStart] |
2842 | mov eax, [ebp+NTFS.fileDataStart] |
2809 | mul [ebp+NTFS.sectors_per_cluster] |
2843 | mul [ebp+NTFS.sectors_per_cluster] |
2810 | pop ecx |
2844 | pop ecx |
2811 | shr ecx, 9 |
2845 | shr ecx, 9 |
2812 | call fs_write64_app |
2846 | call fs_write64_app |
2813 | push ebx |
- | |
2814 | mov ebx, eax |
- | |
2815 | call kernel_free |
2847 | stdcall kernel_free, ebx |
2816 | test ebx, ebx |
- | |
2817 | jnz .err4 |
- | |
2818 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
2848 | mov esi, [ebp+NTFS.attr_offs] |
2819 | add esi, [esi+sizeWithHeader] |
2849 | add esi, [esi+sizeWithHeader] |
2820 | mov ecx, [ebp+NTFS.frs_buffer] |
2850 | mov ecx, [ebp+NTFS.frs_buffer] |
2821 | add ecx, [ecx+recordRealSize] |
2851 | add ecx, [ecx+recordRealSize] |
2822 | sub ecx, esi |
2852 | sub ecx, esi |
2823 | shr ecx, 2 |
2853 | shr ecx, 2 |
2824 | lea edi, [ebp+NTFS.ntfs_bitmap_buf] |
2854 | lea edi, [ebp+NTFS.bitmap_buf] |
2825 | push ecx |
2855 | push ecx |
2826 | rep movsd |
2856 | rep movsd |
2827 | mov edi, [ebp+NTFS.ntfs_attr_offs] |
2857 | mov edi, [ebp+NTFS.attr_offs] |
2828 | add edi, 16 |
2858 | add edi, 16 |
2829 | mov cl, 6 |
2859 | mov cl, 6 |
2830 | xor eax, eax |
2860 | xor eax, eax |
2831 | rep stosd |
2861 | rep stosd |
2832 | mov edi, [ebp+NTFS.ntfs_attr_offs] |
2862 | mov edi, [ebp+NTFS.attr_offs] |
2833 | mov eax, [ebp+NTFS.fileDataSize] |
2863 | mov eax, [ebp+NTFS.fileDataSize] |
2834 | dec eax |
2864 | dec eax |
2835 | mov [edi+lastVCN], eax |
2865 | mov [edi+lastVCN], eax |
2836 | inc eax |
2866 | inc eax |
2837 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
2867 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
Line 2840... | Line 2870... | ||
2840 | mov byte [edi+sizeWithHeader], 50h |
2870 | mov byte [edi+sizeWithHeader], 50h |
2841 | mov byte [edi+nonResidentFlag], 1 |
2871 | mov byte [edi+nonResidentFlag], 1 |
2842 | mov byte [edi+dataRunsOffset], 40h |
2872 | mov byte [edi+dataRunsOffset], 40h |
2843 | mov [edi+attributeAllocatedSize], eax |
2873 | mov [edi+attributeAllocatedSize], eax |
2844 | mov [edi+attributeAllocatedSize+4], edx |
2874 | mov [edi+attributeAllocatedSize+4], edx |
2845 | mov eax, dword [ebp+NTFS.ntfs_attr_size] |
2875 | mov eax, dword [ebp+NTFS.attr_size] |
2846 | mov edx, dword [ebp+NTFS.ntfs_attr_size+4] |
2876 | mov edx, dword [ebp+NTFS.attr_size+4] |
2847 | mov [edi+attributeRealSize], eax |
2877 | mov [edi+attributeRealSize], eax |
2848 | mov [edi+attributeRealSize+4], edx |
2878 | mov [edi+attributeRealSize+4], edx |
2849 | mov [edi+initialDataSize], eax |
2879 | mov [edi+initialDataSize], eax |
2850 | mov [edi+initialDataSize+4], edx |
2880 | mov [edi+initialDataSize+4], edx |
2851 | mov esi, edi |
2881 | mov esi, edi |
2852 | add edi, 40h |
2882 | add edi, 40h |
2853 | call createMcbEntry |
2883 | call createMcbEntry |
2854 | mov eax, edi |
2884 | mov eax, edi |
2855 | mov edi, [ebp+NTFS.ntfs_attr_offs] |
2885 | mov edi, [ebp+NTFS.attr_offs] |
2856 | sub eax, edi |
2886 | sub eax, edi |
2857 | add eax, 8 |
2887 | add eax, 8 |
2858 | and eax, not 7 |
2888 | and eax, not 7 |
2859 | mov [edi+sizeWithHeader], eax |
2889 | mov [edi+sizeWithHeader], eax |
2860 | pop ecx |
2890 | pop ecx |
2861 | lea esi, [ebp+NTFS.ntfs_bitmap_buf] |
2891 | lea esi, [ebp+NTFS.bitmap_buf] |
2862 | add edi, eax |
2892 | add edi, eax |
2863 | rep movsd |
2893 | rep movsd |
2864 | mov esi, [ebp+NTFS.frs_buffer] |
2894 | mov esi, [ebp+NTFS.frs_buffer] |
2865 | sub edi, esi |
2895 | sub edi, esi |
2866 | mov [esi+recordRealSize], edi |
2896 | mov [esi+recordRealSize], edi |
2867 | pop edx |
2897 | pop edx |
2868 | mov ecx, [ebp+NTFS.fileDataSize] |
- | |
2869 | sub [ebp+NTFS.fileDataSize], edx |
2898 | sub [ebp+NTFS.fileDataSize], edx |
2870 | mov eax, [ebp+NTFS.fileDataStart] |
- | |
2871 | add [ebp+NTFS.fileDataStart], edx |
2899 | add [ebp+NTFS.fileDataStart], edx |
2872 | jmp .writeBitmap |
2900 | ret |
Line 2873... | Line 2901... | ||
2873 | 2901 | ||
2874 | .makeResident: ; convert non-resident to empty resident |
2902 | .makeResident: ; convert non-resident to empty resident |
2875 | movzx eax, byte [esi+dataRunsOffset] |
2903 | movzx eax, byte [esi+dataRunsOffset] |
2876 | mov byte [esi+nonResidentFlag], 0 |
2904 | mov byte [esi+nonResidentFlag], 0 |
Line 2916... | Line 2944... | ||
2916 | mov ebx, eax |
2944 | mov ebx, eax |
2917 | xor eax, eax |
2945 | xor eax, eax |
2918 | rep stosd |
2946 | rep stosd |
2919 | mov eax, [ebp+NTFS.fileDataStart] |
2947 | mov eax, [ebp+NTFS.fileDataStart] |
2920 | mul [ebp+NTFS.sectors_per_cluster] |
2948 | mul [ebp+NTFS.sectors_per_cluster] |
2921 | mov [ebp+NTFS.ntfsLastRead], eax |
2949 | mov [ebp+NTFS.LastRead], eax |
2922 | pop ecx |
2950 | pop ecx |
2923 | call fs_write64_app |
2951 | call fs_write64_app |
2924 | stdcall kernel_free, ebx |
2952 | stdcall kernel_free, ebx |
2925 | @@: |
2953 | @@: |
2926 | ret |
2954 | ret |
Line 2927... | Line 2955... | ||
2927 | 2955 | ||
2928 | ntfsSpaceAlloc: |
2956 | ntfsSpaceAlloc: |
2929 | ; find and mark block of free space in bitmap buffer |
2957 | ; allocate disk space |
2930 | ; in: |
2958 | ; in: |
2931 | ; edi = offset in bitmap to start search from |
2959 | ; edi = offset in bitmap to start search from |
2932 | ; [ebp+NTFS.fileDataSize] = block size in clusters |
2960 | ; [ebp+NTFS.fileDataSize] = block size in clusters |
2933 | ; out: |
2961 | ; out: |
2934 | ; eax = allocated block starting cluster |
2962 | ; [ebp+NTFS.fileDataStart] = allocated block starting cluster |
- | 2963 | ; CF=1 -> disk full |
|
2935 | ; CF=1 -> disk full |
2964 | push eax |
2936 | mov ecx, [ebp+NTFS.BitmapBuffer] |
2965 | mov ecx, [ebp+NTFS.BitmapBuffer] |
2937 | add edi, ecx |
2966 | add edi, ecx |
2938 | add ecx, [ebp+NTFS.BitmapSize] |
2967 | add ecx, [ebp+NTFS.BitmapSize] |
2939 | sub ecx, edi |
2968 | sub ecx, edi |
Line 2943... | Line 2972... | ||
2943 | @@: |
2972 | @@: |
2944 | shr ecx, 2 |
2973 | shr ecx, 2 |
2945 | mov eax, [ebp+NTFS.fileDataSize] |
2974 | mov eax, [ebp+NTFS.fileDataSize] |
2946 | shr eax, 5 |
2975 | shr eax, 5 |
2947 | jz .small |
2976 | jz .small |
2948 | push eax ; bitmap dwords |
2977 | mov ebx, eax ; bitmap dwords |
2949 | .start: |
2978 | .start: |
2950 | mov ecx, [ebp+NTFS.BitmapBuffer] |
2979 | mov ecx, [ebp+NTFS.BitmapBuffer] |
2951 | add ecx, [ebp+NTFS.BitmapSize] |
2980 | add ecx, [ebp+NTFS.BitmapSize] |
2952 | sub ecx, edi |
2981 | sub ecx, edi |
2953 | shr ecx, 2 |
2982 | shr ecx, 2 |
Line 2956... | Line 2985... | ||
2956 | repnz scasd ; search for empty dword |
2985 | repnz scasd ; search for empty dword |
2957 | jz @f |
2986 | jz @f |
2958 | call bitmapBuffering |
2987 | call bitmapBuffering |
2959 | jmp @b |
2988 | jmp @b |
2960 | @@: |
2989 | @@: |
2961 | cmp ecx, [esp] |
2990 | cmp ecx, ebx |
2962 | jnc @f |
2991 | jnc @f |
2963 | call bitmapBuffering |
2992 | call bitmapBuffering |
2964 | jmp @b |
2993 | jmp @b |
2965 | @@: |
2994 | @@: |
2966 | sub edi, 4 |
2995 | sub edi, 4 |
2967 | mov ecx, [esp] |
2996 | mov ecx, ebx |
2968 | mov esi, edi |
2997 | mov esi, edi |
2969 | xor eax, eax |
2998 | xor eax, eax |
2970 | repz scasd ; check following dwords |
2999 | repz scasd ; check following dwords |
2971 | jnz .start |
3000 | jnz .start |
2972 | sub esi, 4 |
3001 | sub esi, 4 |
Line 2995... | Line 3024... | ||
2995 | jmp .start |
3024 | jmp .start |
Line 2996... | Line 3025... | ||
2996 | 3025 | ||
2997 | .small: ; less than 32 clusters |
3026 | .small: ; less than 32 clusters |
2998 | mov eax, -1 |
3027 | mov eax, -1 |
2999 | repz scasd ; search for zero bits |
- | |
3000 | push ecx |
3028 | repz scasd ; search for zero bits |
3001 | test ecx, ecx |
3029 | test ecx, ecx |
3002 | jnz @f |
3030 | jnz @f |
3003 | call bitmapBuffering |
- | |
3004 | pop eax |
3031 | call bitmapBuffering |
3005 | jmp .small |
3032 | jmp .small |
3006 | @@: |
3033 | @@: |
3007 | sub edi, 4 |
3034 | sub edi, 4 |
3008 | mov eax, [edi] |
3035 | mov eax, [edi] |
3009 | not eax |
3036 | not eax |
3010 | @@: |
3037 | @@: |
3011 | bsf ecx, eax ; first 0 |
3038 | bsf ebx, eax ; first 0 |
3012 | jz .again |
3039 | jz .again |
3013 | not eax |
3040 | not eax |
3014 | shr eax, cl |
3041 | shr eax, cl |
3015 | shl eax, cl |
3042 | shl eax, cl |
3016 | bsf edx, eax ; next 1 |
3043 | bsf edx, eax ; next 1 |
3017 | jz @f |
3044 | jz @f |
3018 | sub edx, ecx |
3045 | sub edx, ebx |
3019 | cmp edx, [ebp+NTFS.fileDataSize] |
3046 | cmp edx, [ebp+NTFS.fileDataSize] |
3020 | jnc .got ; fits inside |
3047 | jnc .got ; fits inside |
3021 | bsf ecx, eax |
3048 | bsf ebx, eax |
3022 | not eax |
3049 | not eax |
3023 | shr eax, cl |
3050 | shr eax, cl |
3024 | shl eax, cl |
3051 | shl eax, cl |
3025 | jmp @b |
3052 | jmp @b |
3026 | @@: ; next dword |
3053 | @@: ; next dword |
3027 | mov eax, [edi+4] |
3054 | mov eax, [edi+4] |
3028 | bsf edx, eax |
3055 | bsf edx, eax |
3029 | jz .got ; empty |
3056 | jz .got ; empty |
3030 | add edx, 32 |
3057 | add edx, 32 |
3031 | sub edx, ecx |
3058 | sub edx, ebx |
3032 | cmp edx, [ebp+NTFS.fileDataSize] |
3059 | cmp edx, [ebp+NTFS.fileDataSize] |
3033 | jnc .got ; share between dwords |
3060 | jnc .got ; share between dwords |
3034 | .again: |
3061 | .again: |
3035 | add edi, 4 |
- | |
3036 | pop ecx |
3062 | add edi, 4 |
Line 3037... | Line 3063... | ||
3037 | jmp .small |
3063 | jmp .small |
3038 | 3064 | ||
3039 | .got: |
3065 | .got: |
3040 | push ecx ; starting bit |
3066 | push ebx ; starting bit |
3041 | push edi ; starting dword |
3067 | push edi ; starting dword |
3042 | .done: ; mark space |
3068 | .done: ; mark space |
3043 | mov ecx, [esp+4] |
3069 | mov ecx, [esp+4] |
Line 3076... | Line 3102... | ||
3076 | shl eax, cl |
3102 | shl eax, cl |
3077 | not eax |
3103 | not eax |
3078 | or [edi], eax |
3104 | or [edi], eax |
3079 | .end: |
3105 | .end: |
3080 | pop eax |
3106 | pop eax |
- | 3107 | pop ecx |
|
3081 | sub eax, [ebp+NTFS.BitmapBuffer] |
3108 | sub eax, [ebp+NTFS.BitmapBuffer] |
3082 | shl eax, 3 |
3109 | shl eax, 3 |
- | 3110 | add eax, ecx |
|
3083 | pop edx |
3111 | pop ecx |
- | 3112 | mov ecx, [ebp+NTFS.fileDataSize] |
|
- | 3113 | mov [ebp+NTFS.fileDataStart], eax |
|
3084 | add eax, edx |
3114 | add ecx, eax |
- | 3115 | add ecx, 4095 |
|
- | 3116 | shr ecx, 3+9 |
|
- | 3117 | shr eax, 3+9 |
|
- | 3118 | sub ecx, eax |
|
- | 3119 | mov ebx, eax |
|
3085 | pop edx |
3120 | shl ebx, 9 |
- | 3121 | add eax, [ebp+NTFS.BitmapLocation] |
|
- | 3122 | add ebx, [ebp+NTFS.BitmapBuffer] |
|
3086 | ret |
3123 | xor edx, edx |
- | 3124 | jmp fs_write64_app |
|
Line 3087... | Line 3125... | ||
3087 | 3125 | ||
3088 | ntfsSpaceFree: |
3126 | ntfsSpaceFree: |
3089 | ; free disk space |
3127 | ; free disk space |
3090 | ; in: |
3128 | ; in: |
Line 3196... | Line 3234... | ||
3196 | mov eax, [ebp+NTFS.BitmapBuffer] |
3234 | mov eax, [ebp+NTFS.BitmapBuffer] |
3197 | add eax, [ebp+NTFS.BitmapSize] |
3235 | add eax, [ebp+NTFS.BitmapSize] |
3198 | mov ecx, 8 |
3236 | mov ecx, 8 |
3199 | call release_pages |
3237 | call release_pages |
3200 | .end: |
3238 | .end: |
3201 | pop ebx |
- | |
3202 | pop eax ; ret |
3239 | add esp, 12 ; ret |
3203 | pop eax |
- | |
3204 | stc |
3240 | stc |
3205 | ret |
3241 | ret |
Line 3206... | Line 3242... | ||
3206 | 3242 | ||
3207 | ;---------------------------------------------------------------- |
3243 | ;---------------------------------------------------------------- |
Line 3213... | Line 3249... | ||
3213 | ret |
3249 | ret |
3214 | @@: |
3250 | @@: |
3215 | call ntfs_lock |
3251 | call ntfs_lock |
3216 | stdcall ntfs_find_lfn, [esp+4] |
3252 | stdcall ntfs_find_lfn, [esp+4] |
3217 | jc ntfsNotFound |
3253 | jc ntfsNotFound |
3218 | cmp [ebp+NTFS.ntfs_cur_iRecord], 16 |
3254 | cmp [ebp+NTFS.cur_iRecord], 16 |
3219 | jc ntfsDenied |
3255 | jc ntfsDenied |
3220 | bt dword [eax+fileFlags], 28 |
3256 | bt dword [eax+fileFlags], 28 |
3221 | jc ntfsDenied |
3257 | jc ntfsDenied |
3222 | cmp [ebp+NTFS.ntfsFragmentCount], 1 |
3258 | cmp [ebp+NTFS.fragmentCount], 1 |
3223 | jnz ntfsUnsupported ; record fragmented |
3259 | jnz ntfsUnsupported ; record fragmented |
3224 | ; edit directory node |
3260 | ; edit directory node |
3225 | mov edi, [ebp+NTFS.cur_index_buf] |
3261 | mov edi, [ebp+NTFS.cur_index_buf] |
3226 | cmp dword [edi], 'INDX' |
3262 | cmp dword [edi], 'INDX' |
3227 | jz @f |
3263 | jz @f |
3228 | mov esi, [ebp+NTFS.frs_buffer] |
3264 | mov esi, [ebp+NTFS.frs_buffer] |
3229 | mov ecx, [esi+recordRealSize] |
3265 | mov ecx, [esi+recordRealSize] |
3230 | shr ecx, 2 |
3266 | shr ecx, 2 |
3231 | rep movsd |
3267 | rep movsd |
3232 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
3268 | mov esi, [ebp+NTFS.attr_offs] |
3233 | mov cl, [esi+attributeOffset] |
3269 | mov cl, [esi+attributeOffset] |
3234 | sub esi, [ebp+NTFS.frs_buffer] |
3270 | sub esi, [ebp+NTFS.frs_buffer] |
3235 | add eax, ecx |
3271 | add eax, ecx |
3236 | add eax, esi |
3272 | add eax, esi |
3237 | @@: |
3273 | @@: |
Line 3239... | Line 3275... | ||
3239 | mov edx, [ebx+8] |
3275 | mov edx, [ebx+8] |
3240 | add ecx, [ebx+12] |
3276 | add ecx, [ebx+12] |
3241 | adc edx, 0 |
3277 | adc edx, 0 |
3242 | mov [eax+fileRealSize], ecx |
3278 | mov [eax+fileRealSize], ecx |
3243 | mov [eax+fileRealSize+4], edx |
3279 | mov [eax+fileRealSize+4], edx |
3244 | mov eax, [ebp+NTFS.ntfsLastRead] |
3280 | mov eax, [ebp+NTFS.LastRead] |
3245 | mov [ebp+NTFS.nodeLastRead], eax |
3281 | mov [ebp+NTFS.nodeLastRead], eax |
3246 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 |
3282 | mov [ebp+NTFS.cur_attr], 0x80 |
3247 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
3283 | mov [ebp+NTFS.cur_offs], 0 |
3248 | mov [ebp+NTFS.ntfs_cur_size], 0 |
3284 | mov [ebp+NTFS.cur_size], 0 |
3249 | call ntfs_read_attr |
3285 | call ntfs_read_attr |
3250 | jc ntfsFail |
3286 | jc ntfsFail |
3251 | mov eax, ecx |
3287 | mov eax, ecx |
3252 | mov ecx, [ebp+NTFS.frs_buffer] |
3288 | mov ecx, [ebp+NTFS.frs_buffer] |
3253 | cmp word [ecx+baseRecordReuse], 0 |
3289 | cmp word [ecx+baseRecordReuse], 0 |
3254 | jnz ntfsUnsupported ; auxiliary record |
3290 | jnz ntfsUnsupported ; auxiliary record |
3255 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
3291 | mov ecx, [ebp+NTFS.attr_offs] |
3256 | cmp word [ecx+attributeFlags], 0 |
3292 | cmp word [ecx+attributeFlags], 0 |
3257 | jnz ntfsUnsupported |
3293 | jnz ntfsUnsupported |
3258 | push ebx |
3294 | push ebx |
3259 | cmp byte [ecx+nonResidentFlag], 0 |
3295 | cmp byte [ecx+nonResidentFlag], 0 |
3260 | jz .resizeAttribute |
3296 | jz .resizeAttribute |
Line 3264... | Line 3300... | ||
3264 | cmp [ecx+attributeRealSize], eax |
3300 | cmp [ecx+attributeRealSize], eax |
3265 | jnc .writeNode |
3301 | jnc .writeNode |
3266 | .resizeAttribute: |
3302 | .resizeAttribute: |
3267 | call resizeAttribute |
3303 | call resizeAttribute |
3268 | jc ntfsErrorPop |
3304 | jc ntfsErrorPop |
3269 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
3305 | mov ecx, [ebp+NTFS.attr_offs] |
3270 | cmp byte [ecx+nonResidentFlag], 1 |
3306 | cmp byte [ecx+nonResidentFlag], 1 |
3271 | jz @f |
3307 | jz @f |
3272 | mov ebx, [esp] |
3308 | mov ebx, [esp] |
3273 | movzx edi, byte [ecx+attributeOffset] |
3309 | movzx edi, byte [ecx+attributeOffset] |
3274 | add edi, ecx |
3310 | add edi, ecx |
Line 3276... | Line 3312... | ||
3276 | mov ecx, [ebx+12] |
3312 | mov ecx, [ebx+12] |
3277 | mov esi, [ebx+16] |
3313 | mov esi, [ebx+16] |
3278 | rep movsb |
3314 | rep movsb |
3279 | @@: |
3315 | @@: |
3280 | mov eax, [ebp+NTFS.frs_buffer] |
3316 | mov eax, [ebp+NTFS.frs_buffer] |
3281 | mov [ebp+NTFS.ntfs_cur_buf], eax |
3317 | mov [ebp+NTFS.cur_buf], eax |
3282 | call writeRecord ; file |
3318 | call writeRecord ; file |
3283 | mov ebx, [ebp+NTFS.frs_buffer] |
3319 | mov ebx, [ebp+NTFS.frs_buffer] |
3284 | call ntfs_restore_usa_frs |
3320 | call ntfs_restore_usa_frs |
3285 | .writeNode: |
3321 | .writeNode: |
3286 | mov eax, [ebp+NTFS.nodeLastRead] |
3322 | mov eax, [ebp+NTFS.nodeLastRead] |
3287 | mov [ebp+NTFS.ntfsLastRead], eax |
3323 | mov [ebp+NTFS.LastRead], eax |
3288 | mov eax, [ebp+NTFS.cur_index_buf] |
3324 | mov eax, [ebp+NTFS.cur_index_buf] |
3289 | mov [ebp+NTFS.ntfs_cur_buf], eax |
3325 | mov [ebp+NTFS.cur_buf], eax |
3290 | call writeRecord ; directory |
3326 | call writeRecord ; directory |
3291 | pop ebx |
3327 | pop ebx |
3292 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
3328 | mov ecx, [ebp+NTFS.attr_offs] |
3293 | cmp byte [ecx+nonResidentFlag], 0 |
3329 | cmp byte [ecx+nonResidentFlag], 0 |
3294 | jz .done |
3330 | jz .done |
3295 | mov ecx, [ebx+12] |
3331 | mov ecx, [ebx+12] |
3296 | test ecx, ecx |
3332 | test ecx, ecx |
3297 | jz .done |
3333 | jz .done |
Line 3299... | Line 3335... | ||
3299 | mov edx, [ebx+8] |
3335 | mov edx, [ebx+8] |
3300 | mov esi, [ebx+16] |
3336 | mov esi, [ebx+16] |
3301 | shrd eax, edx, 9 |
3337 | shrd eax, edx, 9 |
3302 | test dword[ebx+4], 1FFh |
3338 | test dword[ebx+4], 1FFh |
3303 | jz .aligned |
3339 | jz .aligned |
3304 | mov [ebp+NTFS.ntfs_cur_offs], eax |
3340 | mov [ebp+NTFS.cur_offs], eax |
3305 | mov [ebp+NTFS.ntfs_cur_size], 1 |
3341 | mov [ebp+NTFS.cur_size], 1 |
3306 | lea edi, [ebp+NTFS.ntfs_bitmap_buf] |
3342 | lea edi, [ebp+NTFS.bitmap_buf] |
3307 | mov [ebp+NTFS.ntfs_cur_buf], edi |
3343 | mov [ebp+NTFS.cur_buf], edi |
3308 | call ntfs_read_attr.continue |
3344 | call ntfs_read_attr.continue |
3309 | jc ntfsDevice |
3345 | jc ntfsDevice |
3310 | mov eax, [ebx+4] |
3346 | mov eax, [ebx+4] |
3311 | and eax, 1FFh |
3347 | and eax, 1FFh |
3312 | add edi, eax |
3348 | add edi, eax |
3313 | sub eax, [ebp+NTFS.ntfs_cur_read] |
3349 | sub eax, [ebp+NTFS.cur_read] |
3314 | neg eax |
3350 | neg eax |
3315 | push ecx |
3351 | push ecx |
3316 | cmp ecx, eax |
3352 | cmp ecx, eax |
3317 | jb @f |
3353 | jb @f |
3318 | mov ecx, eax |
3354 | mov ecx, eax |
3319 | @@: |
3355 | @@: |
3320 | sub [esp], ecx |
3356 | sub [esp], ecx |
3321 | rep movsb |
3357 | rep movsb |
3322 | push ebx |
3358 | push ebx |
3323 | mov eax, [ebp+NTFS.ntfsLastRead] |
3359 | mov eax, [ebp+NTFS.LastRead] |
3324 | lea ebx, [ebp+NTFS.ntfs_bitmap_buf] |
3360 | lea ebx, [ebp+NTFS.bitmap_buf] |
3325 | mov ecx, 1 |
3361 | mov ecx, 1 |
3326 | xor edx, edx |
3362 | xor edx, edx |
3327 | call fs_write64_app |
3363 | call fs_write64_app |
3328 | pop ebx |
3364 | pop ebx |
3329 | pop ecx |
3365 | pop ecx |
Line 3334... | Line 3370... | ||
3334 | shrd eax, edx, 9 |
3370 | shrd eax, edx, 9 |
3335 | inc eax |
3371 | inc eax |
3336 | .aligned: |
3372 | .aligned: |
3337 | push ecx |
3373 | push ecx |
3338 | shr ecx, 9 |
3374 | shr ecx, 9 |
3339 | mov [ebp+NTFS.ntfs_cur_offs], eax |
3375 | mov [ebp+NTFS.cur_offs], eax |
3340 | mov [ebp+NTFS.ntfs_cur_size], ecx |
3376 | mov [ebp+NTFS.cur_size], ecx |
3341 | mov [ebp+NTFS.ntfs_cur_buf], esi |
3377 | mov [ebp+NTFS.cur_buf], esi |
3342 | add eax, ecx |
3378 | add eax, ecx |
3343 | push eax |
3379 | push eax |
3344 | mov [ebp+NTFS.ntfsWriteAttr], 1 |
3380 | mov [ebp+NTFS.bWriteAttr], 1 |
3345 | call ntfs_read_attr.continue |
3381 | call ntfs_read_attr.continue |
3346 | mov [ebp+NTFS.ntfsWriteAttr], 0 |
3382 | mov [ebp+NTFS.bWriteAttr], 0 |
3347 | pop [ebp+NTFS.ntfs_cur_offs] |
3383 | pop [ebp+NTFS.cur_offs] |
3348 | pop ecx |
3384 | pop ecx |
3349 | jc ntfsDevice |
3385 | jc ntfsDevice |
3350 | and ecx, 1FFh |
3386 | and ecx, 1FFh |
3351 | jz .done |
3387 | jz .done |
3352 | add esi, [ebp+NTFS.ntfs_cur_read] |
3388 | add esi, [ebp+NTFS.cur_read] |
3353 | mov [ebp+NTFS.ntfs_cur_size], 1 |
3389 | mov [ebp+NTFS.cur_size], 1 |
3354 | lea edi, [ebp+NTFS.ntfs_bitmap_buf] |
3390 | lea edi, [ebp+NTFS.bitmap_buf] |
3355 | mov [ebp+NTFS.ntfs_cur_buf], edi |
3391 | mov [ebp+NTFS.cur_buf], edi |
3356 | call ntfs_read_attr.continue |
3392 | call ntfs_read_attr.continue |
3357 | jc ntfsDevice |
3393 | jc ntfsDevice |
3358 | rep movsb |
3394 | rep movsb |
3359 | push ebx |
3395 | push ebx |
3360 | mov eax, [ebp+NTFS.ntfsLastRead] |
3396 | mov eax, [ebp+NTFS.LastRead] |
3361 | lea ebx, [ebp+NTFS.ntfs_bitmap_buf] |
3397 | lea ebx, [ebp+NTFS.bitmap_buf] |
3362 | mov ecx, 1 |
3398 | mov ecx, 1 |
3363 | xor edx, edx |
3399 | xor edx, edx |
3364 | call fs_write64_app |
3400 | call fs_write64_app |
3365 | pop ebx |
3401 | pop ebx |
3366 | .done: |
3402 | .done: |
Line 3376... | Line 3412... | ||
3376 | ret |
3412 | ret |
3377 | @@: |
3413 | @@: |
3378 | call ntfs_lock |
3414 | call ntfs_lock |
3379 | stdcall ntfs_find_lfn, [esp+4] |
3415 | stdcall ntfs_find_lfn, [esp+4] |
3380 | jc ntfsNotFound |
3416 | jc ntfsNotFound |
3381 | cmp [ebp+NTFS.ntfs_cur_iRecord], 16 |
3417 | cmp [ebp+NTFS.cur_iRecord], 16 |
3382 | jc ntfsDenied |
3418 | jc ntfsDenied |
3383 | cmp [ebp+NTFS.ntfsFragmentCount], 1 |
3419 | cmp [ebp+NTFS.fragmentCount], 1 |
3384 | jnz ntfsUnsupported ; record fragmented |
3420 | jnz ntfsUnsupported ; record fragmented |
3385 | test byte [eax+indexFlags], 1 |
3421 | test byte [eax+indexFlags], 1 |
3386 | jnz ntfsUnsupported ; index has a subnode |
3422 | jnz ntfsUnsupported ; index has a subnode |
3387 | mov edx, [ebp+NTFS.ntfs_cur_iRecord] |
3423 | mov edx, [ebp+NTFS.cur_iRecord] |
3388 | shr edx, 3 |
3424 | shr edx, 3 |
3389 | cmp edx, [ebp+NTFS.mftBitmapSize] |
3425 | cmp edx, [ebp+NTFS.mftBitmapSize] |
3390 | jnc ntfsUnsupported |
3426 | jnc ntfsUnsupported |
3391 | ; delete index from the node |
3427 | ; delete index from the node |
3392 | movzx edx, word [eax+indexAllocatedSize] |
3428 | movzx edx, word [eax+indexAllocatedSize] |
Line 3401... | Line 3437... | ||
3401 | mov esi, [ebp+NTFS.frs_buffer] ; indexRoot |
3437 | mov esi, [ebp+NTFS.frs_buffer] ; indexRoot |
3402 | mov ecx, [esi+recordRealSize] |
3438 | mov ecx, [esi+recordRealSize] |
3403 | shr ecx, 2 |
3439 | shr ecx, 2 |
3404 | rep movsd |
3440 | rep movsd |
3405 | mov esi, [ebp+NTFS.cur_index_buf] |
3441 | mov esi, [ebp+NTFS.cur_index_buf] |
3406 | mov edi, [ebp+NTFS.ntfs_attr_offs] |
3442 | mov edi, [ebp+NTFS.attr_offs] |
3407 | sub edi, [ebp+NTFS.frs_buffer] |
3443 | sub edi, [ebp+NTFS.frs_buffer] |
3408 | add edi, esi |
3444 | add edi, esi |
3409 | sub [edi+sizeWithHeader], edx |
3445 | sub [edi+sizeWithHeader], edx |
3410 | sub [edi+sizeWithoutHeader], edx |
3446 | sub [edi+sizeWithoutHeader], edx |
3411 | mov cl, [edi+attributeOffset] |
3447 | mov cl, [edi+attributeOffset] |
3412 | add edi, ecx |
3448 | add edi, ecx |
3413 | sub [edi+16+nodeRealSize], edx |
3449 | sub [edi+rootNode+nodeRealSize], edx |
3414 | sub [edi+16+nodeAllocatedSize], edx |
3450 | sub [edi+rootNode+nodeAllocatedSize], edx |
3415 | sub eax, esi |
3451 | sub eax, esi |
3416 | add eax, edi |
3452 | add eax, edi |
3417 | sub [esi+recordRealSize], edx |
3453 | sub [esi+recordRealSize], edx |
3418 | mov ecx, [esi+recordRealSize] |
3454 | mov ecx, [esi+recordRealSize] |
3419 | jmp @f |
3455 | jmp @f |
Line 3420... | Line 3456... | ||
3420 | 3456 | ||
- | 3457 | .indexRecord: |
|
3421 | .indexRecord: |
3458 | add edi, recordNode+nodeRealSize |
3422 | sub [edi+28], edx |
3459 | sub [edi], edx |
3423 | mov ecx, [edi+28] |
3460 | mov ecx, [edi] |
3424 | add ecx, 24 |
3461 | add ecx, recordNode |
3425 | @@: |
3462 | @@: |
3426 | add ecx, [ebp+NTFS.cur_index_buf] |
3463 | add ecx, [ebp+NTFS.cur_index_buf] |
3427 | sub ecx, eax |
3464 | sub ecx, eax |
3428 | shr ecx, 2 |
3465 | shr ecx, 2 |
3429 | mov esi, eax |
3466 | mov esi, eax |
3430 | add esi, edx |
3467 | add esi, edx |
3431 | mov edi, eax |
3468 | mov edi, eax |
3432 | rep movsd |
3469 | rep movsd |
3433 | mov eax, [ebp+NTFS.ntfsLastRead] |
3470 | mov eax, [ebp+NTFS.LastRead] |
3434 | mov [ebp+NTFS.nodeLastRead], eax |
3471 | mov [ebp+NTFS.nodeLastRead], eax |
3435 | ; examine file record |
3472 | ; examine file record |
3436 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 |
3473 | mov [ebp+NTFS.cur_attr], 0x80 |
3437 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
3474 | mov [ebp+NTFS.cur_offs], 0 |
3438 | mov [ebp+NTFS.ntfs_cur_size], 0 |
3475 | mov [ebp+NTFS.cur_size], 0 |
3439 | call ntfs_read_attr |
3476 | call ntfs_read_attr |
3440 | jc .folder |
3477 | jc .folder |
3441 | mov esi, [ebp+NTFS.frs_buffer] |
3478 | mov esi, [ebp+NTFS.frs_buffer] |
3442 | cmp word [esi+baseRecordReuse], 0 |
3479 | cmp word [esi+baseRecordReuse], 0 |
3443 | jnz ntfsUnsupported ; auxiliary record |
3480 | jnz ntfsUnsupported ; auxiliary record |
3444 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
3481 | mov esi, [ebp+NTFS.attr_offs] |
3445 | cmp byte [esi+nonResidentFlag], 0 |
3482 | cmp byte [esi+nonResidentFlag], 0 |
3446 | jz .writeBitmapMFT |
3483 | jz .writeBitmapMFT |
3447 | movzx eax, byte [esi+dataRunsOffset] |
3484 | movzx eax, byte [esi+dataRunsOffset] |
3448 | add esi, eax |
3485 | add esi, eax |
Line 3460... | Line 3497... | ||
3460 | @@: |
3497 | @@: |
3461 | add esp, 16 |
3498 | add esp, 16 |
3462 | jmp .writeBitmapMFT |
3499 | jmp .writeBitmapMFT |
Line 3463... | Line 3500... | ||
3463 | 3500 | ||
3464 | .folder: ; empty? |
3501 | .folder: ; empty? |
3465 | lea esi, [ebp+NTFS.ntfs_bitmap_buf] |
3502 | lea esi, [ebp+NTFS.bitmap_buf] |
3466 | mov [ebp+NTFS.ntfs_cur_buf], esi |
3503 | mov [ebp+NTFS.cur_buf], esi |
3467 | mov [ebp+NTFS.ntfs_cur_attr], 0x90 |
3504 | mov [ebp+NTFS.cur_attr], 0x90 |
3468 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
3505 | mov [ebp+NTFS.cur_offs], 0 |
3469 | mov [ebp+NTFS.ntfs_cur_size], 1 |
3506 | mov [ebp+NTFS.cur_size], 1 |
3470 | call ntfs_read_attr |
3507 | call ntfs_read_attr |
3471 | cmp [ebp+NTFS.ntfs_cur_read], 48 |
3508 | cmp [ebp+NTFS.cur_read], 48 |
3472 | jnz ntfsDenied |
3509 | jnz ntfsDenied |
3473 | test byte [esi+32+indexFlags], 1 |
3510 | test byte [esi+32+indexFlags], 1 |
3474 | jnz ntfsDenied |
3511 | jnz ntfsDenied |
3475 | .writeBitmapMFT: ; "delete" file record |
3512 | .writeBitmapMFT: ; "delete" file record |
3476 | mov eax, [ebp+NTFS.ntfs_cur_iRecord] |
3513 | mov eax, [ebp+NTFS.cur_iRecord] |
3477 | mov ecx, eax |
3514 | mov ecx, eax |
3478 | shr eax, 3 |
3515 | shr eax, 3 |
3479 | and ecx, 7 |
3516 | and ecx, 7 |
3480 | mov edi, [ebp+NTFS.mftBitmapBuffer] |
3517 | mov edi, [ebp+NTFS.mftBitmapBuffer] |
Line 3486... | Line 3523... | ||
3486 | add ebx, edi |
3523 | add ebx, edi |
3487 | mov ecx, 1 |
3524 | mov ecx, 1 |
3488 | xor edx, edx |
3525 | xor edx, edx |
3489 | call fs_write64_sys |
3526 | call fs_write64_sys |
3490 | mov esi, [ebp+NTFS.frs_buffer] |
3527 | mov esi, [ebp+NTFS.frs_buffer] |
3491 | mov [ebp+NTFS.ntfs_cur_buf], esi |
3528 | mov [ebp+NTFS.cur_buf], esi |
3492 | mov byte [esi+recordFlags], 0 |
3529 | mov byte [esi+recordFlags], 0 |
3493 | call writeRecord |
3530 | call writeRecord |
3494 | ; write directory node |
3531 | ; write directory node |
3495 | mov eax, [ebp+NTFS.nodeLastRead] |
3532 | mov eax, [ebp+NTFS.nodeLastRead] |
3496 | mov [ebp+NTFS.ntfsLastRead], eax |
3533 | mov [ebp+NTFS.LastRead], eax |
3497 | mov eax, [ebp+NTFS.cur_index_buf] |
3534 | mov eax, [ebp+NTFS.cur_index_buf] |
3498 | mov [ebp+NTFS.ntfs_cur_buf], eax |
3535 | mov [ebp+NTFS.cur_buf], eax |
3499 | call writeRecord |
3536 | call writeRecord |
3500 | jmp ntfsDone |
3537 | jmp ntfsDone |
Line 3501... | Line 3538... | ||
3501 | 3538 | ||
3502 | ;---------------------------------------------------------------- |
3539 | ;---------------------------------------------------------------- |
Line 3508... | Line 3545... | ||
3508 | ret |
3545 | ret |
3509 | @@: |
3546 | @@: |
3510 | call ntfs_lock |
3547 | call ntfs_lock |
3511 | stdcall ntfs_find_lfn, [esp+4] |
3548 | stdcall ntfs_find_lfn, [esp+4] |
3512 | jc ntfsNotFound |
3549 | jc ntfsNotFound |
3513 | cmp [ebp+NTFS.ntfs_cur_iRecord], 16 |
3550 | cmp [ebp+NTFS.cur_iRecord], 16 |
3514 | jc ntfsDenied |
3551 | jc ntfsDenied |
3515 | bt dword [eax+fileFlags], 28 |
3552 | bt dword [eax+fileFlags], 28 |
3516 | jc ntfsDenied |
3553 | jc ntfsDenied |
3517 | cmp [ebp+NTFS.ntfsFragmentCount], 1 |
3554 | cmp [ebp+NTFS.fragmentCount], 1 |
3518 | jnz ntfsUnsupported ; record fragmented |
3555 | jnz ntfsUnsupported ; record fragmented |
3519 | ; edit directory node |
3556 | ; edit directory node |
3520 | mov edi, [ebp+NTFS.cur_index_buf] |
3557 | mov edi, [ebp+NTFS.cur_index_buf] |
3521 | cmp dword [edi], 'INDX' |
3558 | cmp dword [edi], 'INDX' |
3522 | jz @f |
3559 | jz @f |
3523 | mov esi, [ebp+NTFS.frs_buffer] |
3560 | mov esi, [ebp+NTFS.frs_buffer] |
3524 | mov ecx, [esi+recordRealSize] |
3561 | mov ecx, [esi+recordRealSize] |
3525 | shr ecx, 2 |
3562 | shr ecx, 2 |
3526 | rep movsd |
3563 | rep movsd |
3527 | mov esi, [ebp+NTFS.ntfs_attr_offs] |
3564 | mov esi, [ebp+NTFS.attr_offs] |
3528 | mov cl, [esi+attributeOffset] |
3565 | mov cl, [esi+attributeOffset] |
3529 | sub esi, [ebp+NTFS.frs_buffer] |
3566 | sub esi, [ebp+NTFS.frs_buffer] |
3530 | add eax, ecx |
3567 | add eax, ecx |
3531 | add eax, esi |
3568 | add eax, esi |
3532 | @@: |
3569 | @@: |
3533 | mov ecx, [ebx+4] |
3570 | mov ecx, [ebx+4] |
3534 | mov edx, [ebx+8] |
3571 | mov edx, [ebx+8] |
3535 | mov [eax+fileRealSize], ecx |
3572 | mov [eax+fileRealSize], ecx |
3536 | mov [eax+fileRealSize+4], edx |
3573 | mov [eax+fileRealSize+4], edx |
3537 | mov eax, [ebp+NTFS.ntfsLastRead] |
3574 | mov eax, [ebp+NTFS.LastRead] |
3538 | mov [ebp+NTFS.nodeLastRead], eax |
3575 | mov [ebp+NTFS.nodeLastRead], eax |
3539 | mov [ebp+NTFS.ntfs_cur_attr], 0x80 |
3576 | mov [ebp+NTFS.cur_attr], 0x80 |
3540 | mov [ebp+NTFS.ntfs_cur_offs], 0 |
3577 | mov [ebp+NTFS.cur_offs], 0 |
3541 | mov [ebp+NTFS.ntfs_cur_size], 0 |
3578 | mov [ebp+NTFS.cur_size], 0 |
3542 | call ntfs_read_attr |
3579 | call ntfs_read_attr |
3543 | jc ntfsFail |
3580 | jc ntfsFail |
3544 | mov eax, ecx |
3581 | mov eax, ecx |
3545 | mov ecx, [ebp+NTFS.frs_buffer] |
3582 | mov ecx, [ebp+NTFS.frs_buffer] |
3546 | cmp word [ecx+baseRecordReuse], 0 |
3583 | cmp word [ecx+baseRecordReuse], 0 |
3547 | jnz ntfsUnsupported ; auxiliary record |
3584 | jnz ntfsUnsupported ; auxiliary record |
3548 | mov ecx, [ebp+NTFS.ntfs_attr_offs] |
3585 | mov ecx, [ebp+NTFS.attr_offs] |
3549 | cmp word [ecx+attributeFlags], 0 |
3586 | cmp word [ecx+attributeFlags], 0 |
3550 | jnz ntfsUnsupported |
3587 | jnz ntfsUnsupported |
3551 | cmp byte [ecx+nonResidentFlag], 0 |
3588 | cmp byte [ecx+nonResidentFlag], 0 |
3552 | jz .resizeAttribute |
3589 | jz .resizeAttribute |
3553 | cmp [ecx+attributeRealSize+4], edx |
3590 | cmp [ecx+attributeRealSize+4], edx |
3554 | jnz .resizeAttribute |
3591 | jnz .resizeAttribute |
3555 | cmp [ecx+attributeRealSize], eax |
3592 | cmp [ecx+attributeRealSize], eax |
3556 | jnc .resizeAttribute |
3593 | jnc .resizeAttribute |
3557 | mov eax, [ecx+attributeRealSize] |
3594 | mov eax, [ecx+attributeRealSize] |
3558 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
3595 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
3559 | mov [ebp+NTFS.ntfs_cur_size], ecx |
3596 | mov [ebp+NTFS.cur_size], ecx |
3560 | shl ecx, 9 |
3597 | shl ecx, 9 |
3561 | div ecx |
3598 | div ecx |
3562 | test edx, edx |
3599 | test edx, edx |
3563 | jz .aligned |
3600 | jz .aligned |
3564 | push edx |
3601 | push edx |
3565 | push ecx |
3602 | push ecx |
3566 | mul [ebp+NTFS.sectors_per_cluster] |
3603 | mul [ebp+NTFS.sectors_per_cluster] |
3567 | mov [ebp+NTFS.ntfs_cur_offs], eax |
3604 | mov [ebp+NTFS.cur_offs], eax |
3568 | stdcall kernel_alloc, ecx |
3605 | stdcall kernel_alloc, ecx |
3569 | pop ecx |
3606 | pop ecx |
3570 | pop edi |
3607 | pop edi |
3571 | sub ecx, edi |
3608 | sub ecx, edi |
3572 | add edi, eax |
3609 | add edi, eax |
3573 | mov [ebp+NTFS.ntfs_cur_buf], eax |
3610 | mov [ebp+NTFS.cur_buf], eax |
3574 | push [ebp+NTFS.ntfsLastRead] |
3611 | push [ebp+NTFS.LastRead] |
3575 | call ntfs_read_attr.continue |
3612 | call ntfs_read_attr.continue |
3576 | jc @f |
3613 | jc @f |
3577 | xor eax, eax |
3614 | xor eax, eax |
3578 | rep stosb |
3615 | rep stosb |
3579 | push ebx |
3616 | push ebx |
3580 | mov eax, [ebp+NTFS.ntfsLastRead] |
3617 | mov eax, [ebp+NTFS.LastRead] |
3581 | mov ebx, [ebp+NTFS.ntfs_cur_buf] |
3618 | mov ebx, [ebp+NTFS.cur_buf] |
3582 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
3619 | mov ecx, [ebp+NTFS.sectors_per_cluster] |
3583 | xor edx, edx |
3620 | xor edx, edx |
3584 | call fs_write64_app |
3621 | call fs_write64_app |
3585 | pop ebx |
3622 | pop ebx |
3586 | @@: |
3623 | @@: |
3587 | pop [ebp+NTFS.ntfsLastRead] |
3624 | pop [ebp+NTFS.LastRead] |
3588 | stdcall kernel_free, [ebp+NTFS.ntfs_cur_buf] |
3625 | stdcall kernel_free, [ebp+NTFS.cur_buf] |
3589 | .aligned: |
3626 | .aligned: |
3590 | mov eax, [ebx+4] |
3627 | mov eax, [ebx+4] |
3591 | mov edx, [ebx+8] |
3628 | mov edx, [ebx+8] |
3592 | .resizeAttribute: |
3629 | .resizeAttribute: |
3593 | call resizeAttribute |
3630 | call resizeAttribute |
3594 | jc ntfsError |
3631 | jc ntfsError |
3595 | mov eax, [ebp+NTFS.frs_buffer] |
3632 | mov eax, [ebp+NTFS.frs_buffer] |
3596 | mov [ebp+NTFS.ntfs_cur_buf], eax |
3633 | mov [ebp+NTFS.cur_buf], eax |
3597 | call writeRecord ; file |
3634 | call writeRecord ; file |
3598 | mov eax, [ebp+NTFS.nodeLastRead] |
3635 | mov eax, [ebp+NTFS.nodeLastRead] |
3599 | mov [ebp+NTFS.ntfsLastRead], eax |
3636 | mov [ebp+NTFS.LastRead], eax |
3600 | mov eax, [ebp+NTFS.cur_index_buf] |
3637 | mov eax, [ebp+NTFS.cur_index_buf] |
3601 | mov [ebp+NTFS.ntfs_cur_buf], eax |
3638 | mov [ebp+NTFS.cur_buf], eax |
3602 | call writeRecord ; directory |
3639 | call writeRecord ; directory |
3603 | call ntfsSpaceClean |
3640 | call ntfsSpaceClean |
3604 | jmp ntfsDone |
3641 | jmp ntfsDone |
Line 3605... | Line 3642... | ||
3605 | 3642 |